Agent Builder Foundations

MCP vulnerabilities cluster into four layers, each stopped at a different point:

• Execution — arguments reach a shell or eval().
• Management — inspectors, test harnesses, and registration endpoints left unauthenticated.
• Outbound trust — a server can call any URL with a privileged credential.
• Semantic integrity — a tool's definition changes after approval.

A gateway is an inbound routing and auth control. Three of the four failures happen behind it.

Model each MCP server as a small privileged service with its own attack surface, not a trusted host inside a gateway perimeter. Ask four questions:

1. Does it turn caller arguments into a shell command or evaluated code?
2. Are its non-agent interfaces (debug, CI, registration) authenticated?
3. What can it reach outbound, and with which credential?
4. Can its advertised behavior change without anyone noticing?

A gateway answers "who may call this server," a real but separate question.

Execution. A tool passes caller-controlled arguments into a shell string or exec()/eval(): classic command injection, reached through a tool call instead of a web form. The InfoQ analysis attributes 13 of 30 documented CVEs to this. Argument arrays leave nothing to inject into.

Management. MCP tooling ships operational surfaces built with dev-tool casualness and left reachable on production networks. Six CVEs are unauthenticated endpoints that should not have been reachable at all.

Outbound trust. Unrestricted egress plus a broad credential turns one SSRF into credential theft. CVE-2026-26118 let a malicious URL pull an Azure managed-identity token because nothing constrained the destination or scoped the token.

Semantic integrity. In a "rug-pull," the tool a reviewer approved is not the tool that later executes, because the server's advertised definition changed. Pinning a canonical hash of the approved definition turns any change into an explicit review event.

• Audit execution paths first; it is the largest CVE category. Grep for shell=True, exec(), eval(), and string-built commands; require argument arrays and fail CI on violations.
• Treat inspectors, test harnesses, and registration endpoints as production services, with authentication, network isolation, and minimal filesystem access.
• Put an egress allow-list on every server and scope credentials per tool purpose, so one leaked token cannot reach everything the server can.
• Pin tool manifests at registration with a SHA-256 hash of the canonical definition, and require operator review for any material change.
• Add input and context scanning on tool schemas and outputs. COPEX measured a 49.6% mean drop in attack success on an eight-attack subset; it is a mitigation, not a replacement for the controls above.
• Budget for controls beyond the gateway. It provides inbound routing, auth, and observability; execution, outbound, and integrity controls are separate work.

• Equating "behind an authenticated gateway" with "secure."
• Leaving debug or inspector tooling reachable because it "isn't the real API."
• Giving a tool an outbound credential broader than its one integration, so an SSRF becomes full-credential exfiltration.
• Trusting a server's current tool definition indefinitely after first approval.

See MCP, agent sandboxing for execution isolation that complements argument arrays, and prompt injection for the attacker-controlled input behind outbound-trust failures.