04-agents-mcp · 4–8 h · 7 min
MCP security: audit the tools, not just the UI.
An MCP server, a chat wired to SQL, Skills that touch tickets. The value is the agent. So agent 09 runs first, not last. An audit of this product without 09 does not exist.
- When to open it
- MCP server, tools, Skills, copilot wired to data
- “Chat + tools” app (files, browser, SQL, tickets)
- Staging token or account — not a wide production token
- Agents
- 00, 01, 09 first, then 02, 04–08, 10, 11
- Outside this mode
- UI outside agent tools, human auth outside tool delegation
- No offensive jailbreak: we observe what the UI returns
- No production token “just to see”
Why 09 is the star
On a site, the central risk is often the session. On an agent, it is the tool. Who can call it. With which arguments. Against which data. Agent 09 writes the main threat model: user, other tenant, model operator, third-party tool author.
What 09 inspects
- MCP manifests, /.well-known, llms.txt, llms-security.txt, install pages.
- Authz: a tool + another tenant’s identifier.
- Callbacks, webhooks, streaming.
- Prompts, system cards, skill repos, exposed .env.
- Third-party tools, marketplace, models.
- What the agent UI returns: system-prompt leak, as observation.
Launch phrase
Agents / MCP audit. Staging server in the brief. Declared tools if you have them. No prod token.
Before you launch
- Is this a model pentest?
- No. We do not attack weights. We audit delegation: tools, authz, leaks, skill supply chain.
- What about Express?
- If an agent surface appears in Express, we open an Untested finding and recommend this mode. We do not audit it in 30 minutes.
The kit, not the guide.
Open source, MIT. Clone it, open it in Claude, Codex, Cursor or Hermes. A held report — or QA’s silence.