AGA Protocol
Cryptographic governance for AI agents with sealed policy artifacts and continuous measurement.
0Tools
8Findings
0Stars
Mar 24, 2026Last Scanned
4 critical · 3 high · 1 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output
Findings8
4critical
3high
1low
Critical4
criticalC13Server-Side Template InjectionMCP03-command-injection
Pattern "(?:render_template_string|from_string|Template)\s*\(\s*(?:req|input|param|args|body|query|user|f['"])" matched in source_code: "template(args" (at position 16113)
Never pass user-supplied strings directly to template engines as the template itself. Pass user data only as template variables (context). Enable autoescaping. If dynamic templates are required, use a sandboxed environment with no access to server internals.
criticalK5Auto-Approve / Bypass Confirmation PatternMCP06-excessive-permissionsAML.T0054
Pattern "(always|unconditionally)\s+(approv|confirm|accept|allow|permit)" matched in source_code: "always allow" (at position 9470)
Never auto-approve or bypass human confirmation for operations with side effects. Implement explicit confirmation gates that cannot be programmatically bypassed. If batch/CI mode is needed, require an explicit opt-in flag with audit logging. Required by EU AI Act Art. 14 (human oversight) and OWASP ASI09.
criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054
Pattern "["']@modelcontextprotocol/sdk["']\s*:\s*["'](?:\^|~|\*|latest)" matched in source_code: ""@modelcontextprotocol/sdk": "^" (at position 17973)
MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.
criticalQ6Agent Identity Impersonation via MCPMCP05-privilege-escalationAML.T0054
Pattern "(?:agent[_\s-]?id|agent[_\s-]?name|agent[_\s-]?role|caller[_\s-]?agent|source[_\s-]?agent).*(?:param|arg|input|string)" matched in source_code: "agent_id: z.string" (at position 13166)
MCP tools in multi-agent systems must verify agent identity cryptographically — never accept agent_id/agent_role as plain string parameters. Use cryptographic attestation (signed tokens, mTLS certificates, or capability tokens) for inter-agent communication. Implement the principle of least privilege: each agent should only be able to claim its own identity. Reference: OWASP ASI03, arXiv 2602.19555.
High3
highK19Missing Runtime Sandbox EnforcementMCP07-insecure-configAML.T0054
Pattern "(run[_\s-]?as[_\s-]?root|EUID.*0|uid.*0)(?!.*(?:drop|setuid|seteuid|change.?user))" matched in source_code: "uid": "^11.1.0" (at position 18082)
Run MCP servers in sandboxed containers with: (1) No --privileged flag, (2) Minimal Linux capabilities (drop ALL, add only needed), (3) Read-only root filesystem, (4) Non-root user, (5) Seccomp/AppArmor profiles enabled, (6) No host mounts except data volumes. CoSAI warns containers alone are insufficient — add seccomp profiles. Required by CoSAI MCP-T8 and ISO 27001 A.8.22.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "@modelcontextprotocol/sdk@1.12.0" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "vitest@2.1.0" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
Low1
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.