As AI agents call external tools, the Model Context Protocol (MCP) has become the common wiring. Each tool an agent can call is, in effect, a new non-human identity with its own permissions — and a new place for things to go wrong. The protocol itself is documented at modelcontextprotocol.io.
Several risk classes are now well understood in the agent-security community:
- Tool poisoning / tool-description injection — a malicious or compromised tool ships instructions in its description or output that steer the agent.
- Indirect prompt injection — untrusted content the agent reads (a file, a page, a tool result) carries instructions the agent then follows.
- Over-privileged agents — an agent granted far broader tool access than its task requires, so a single compromise has a large blast radius.
- Unmediated delegation hops — an agent acting on behalf of another principal without a verifiable, attested chain back to an accountable owner.
Why this is an identity problem, not just a prompt problem. Each of these is ultimately about what an agent is authorized to do and whether that authority can be proven. Treating the agent and its tools as non-human identities — with passports, scoped grants, and signed delegation receipts — turns a fuzzy "prompt safety" question into a concrete, checkable authorization question.
TrustFix analysis. We capture MCP tool-call and delegation events and surface the supply chain read-only today; the inline mediation layer (verify the passport + the signed MCP baseline before a tool call) is on the roadmap. We tag MCP incidents in this feed by the classes above so a reader can pivot from "tool poisoning" to the sourced reports that describe it.