Topic

Agent Tool Security

The security of tools an autonomous model is permitted to invoke, where request targets and parameters are chosen by the model rather than by a person.

Current clusters

build1 publisher

A page behind Chrome's WebMCP flag registers three agent tools without an MCP server

document.modelContext.registerTool works in Chrome only when enable-webmcp-testing is on, and the demonstration page falls back to a third-party polyfill everywhere else. Its scoring tool runs entirely in the browser.

Publishers:dev.to

Reality

Evidence52
Adoption12
Hype gap+15
Incentives75
Confidence45

build1 publisher

CrawlForge's SSRF guard checked DNS, so a decimal IP walked straight past it

The v5.0.0 audit log - 480 tests to 914, 16 npm advisories to zero, 27 tools unchanged - is a fair price list for hardening a fetch-anything tool an agent drives.

Publishers:dev.to

Reality

Evidence52
Adoption: Insufficient
Hype gap−8
Incentives70
Confidence47