Tools & MCP — Security¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Identity and fencing¶
Callers are attempts (workload identity plus per-attempt token and fencing token), IDE clients (user token through GW-05) or partner agents (workload or federated identity with delegated scope). A call whose fencing token no longer matches the current lease holder is refused; a call outside the caller's project scope is refused before policy.
Classes and approvals (D21)¶
The descriptor declares the side-effect class and a risk class from the original design (READ_ONLY, REVERSIBLE_WRITE, IRREVERSIBLE_WRITE, PRODUCTION, FINANCIAL, SECURITY_SENSITIVE); the executor never lowers a class; the environment class raises writes to production; Frozen environments refuse writes. Gated classes execute only with an approval bound to the request hash and the tool version; the policy may prohibit a class outright (FINANCIAL in most projects).
Sandboxes (original handoff §36–38)¶
| Control | Default |
|---|---|
| Filesystem | isolated workspace per run (git worktree), read-only mounts for inputs |
| Network | egress allow-list (github.com, dev.azure.com, api.nuget.org); arbitrary internet denied |
| Compute | CPU, memory and GPU quotas, execution timeout, process restrictions |
| Credentials | temporary, brokered per invocation, expire with the lease |
| Shell | allow-listed commands run as sandbox class; block-listed commands denied or escalated to production |
| Agents never receive | root shell, host filesystem, cloud admin credentials, production secrets |
Sandbox kinds: containers, microVMs, Kubernetes jobs, isolated Windows environments, restricted runners; None only for read-class native tools.
Credentials¶
No tool receives a long-lived secret: the Secret Broker (BC-40) issues short-lived credentials bound to the invocation, connections (BC-16) hold the references, and receipts record which credential class was used, never its value.
Result sanitization and prompt injection¶
Results are stripped of secrets, bounded in size and tagged tool-result before reaching the model or context assembly; instructions inside results are data. Browser and HTTP results are the most common injection vector and carry the lowest trust tier.
MCP authentication (ADR-0022)¶
Exposed servers require OAuth 2.1 protected-resource or workload identity; consumed servers authenticate through connections; NoneException registrations need a recorded Platform-admin approval with expiry and can be disabled installation-wide. A changed schema on a consumed server unbinds its tools until re-approved.
Audit¶
Every invocation, denial, uncertain effect, confirmation, descriptor activation and retirement, and MCP server state change is consumed by AuditService; shell command lines, exit codes and sandbox identities are on the receipt.