Autonomous and semi-autonomous agents now browse the web, can purchase things, write emails, and affect physical and digital reality. They interact with real people. A single bad tool call — or a paragraph of hostile text buried in a checkout page — can turn a helpful workflow into an expensive, embarrassing, or legally messy incident.
Security for agents is not one firewall. It is a stack: scrub untrusted text before it enters context, inspect surfaces before clicks, gate side effects by provenance, and vet third-party capabilities before you install them. Below are seven real, documented tools and skills that teams are wiring into loops today. Mix and match; none replaces human review for high-stakes actions.
1. Prompt Injection Firewall (offline text gate)
What it does: Deterministic pre-flight scan of untrusted text before it reaches model context — hidden HTML/markdown channels, Unicode smuggling, nested encodings, instruction-override lexicon hits, and corroboration-based severity. No LLM in the audit path; no network required.
When to use: Email bodies, scraped pages, ticket comments, RAG chunks, pasted documents — anywhere user or web content becomes prompt material.
Open registry example: Skillware security/prompt_injection_firewall (stdlib-only Effect; pip install "skillware[security_prompt_injection_firewall]").
Design note: Heuristic scanners trade false positives against false negatives. Pair with tool scoping and confirmation gates for payments or outbound mail.
2. Deceptive UI Guard (pre-click web safety)
What it does: Dual DOM vs visible-surface analysis on HTML — hidden nodes, mislabeled CTAs, deception lexicon, low-contrast “dark pattern” styling — plus a trust score and structured agent guidance before an browser agent clicks checkout or submits a form.
When to use: Shopping agents, form-filling bots, research crawlers that must act on live pages, not just read them.
Open registry example: Skillware security/deceptive_ui_guard.
Design note: Complements text-layer firewalls: a page can look fine to a summarizer and still be hostile to a click agent.
3. PII Masker (privacy edge before the cloud)
What it does: Local detection and redaction of personally identifiable information so raw names, addresses, and account identifiers do not leave your node on the way to a hosted model.
When to use: Support triage, HR workflows, healthcare-adjacent copilots, any loop where the agent reads real customer data then calls an external API.
Open registry example: Skillware compliance/pii_masker (local Ollama path via micro-f1-mask; treat as PoC until fine-tuned on your data).
Design note: Privacy and security overlap here: exfiltration is often accidental — the model “helpfully” quotes what it saw.
4. MCP-Guard (layered MCP defense)
What it does: Multi-stage pipeline for Model Context Protocol traffic: fast pattern scan → semantic embedding detector → optional LLM arbitration. Targets prompt injection, shadow hijacks, shell/SQL patterns, and cross-origin abuse in tool integrations.
When to use: Production stacks that expose MCP tools to agents or copilots; research and benchmarking against adversarial MCP prompts.
Where to read: GenTelLab/MCP-Guard · ACL 2026 findings paper · MCP-AttackBench dataset.
Design note: Useful reference architecture for “fail fast, then go deep” — most requests never hit an expensive judge model.
5. Shrike MCP (runtime scan tools for agent loops)
What it does: MCP server exposing scanners for prompts, responses, SQL, file writes, shell commands, web searches, and agent-to-agent messages — prompt injection, jailbreaks, and PII leakage before execution.
When to use: Claude Desktop, Cursor, Windsurf, Cline, or custom hosts that already speak MCP and need guardrails without rewriting the agent core.
Where to read: Shrike-Security/shrike-mcp · scan_prompt / scan_tool_call tool matrix in README.
Design note: Fits teams that want tools the agent can call rather than a transparent proxy — explicit scan steps show up in traces.
6. MCP Injection Guard (provenance / taint, not regex)
What it does: Tracks data lineage instead of hunting suspicious phrases. Content from untrusted fetches is tainted; side-effectful actions (email, file write, shell) are blocked when arguments trace back to tainted sources.
When to use: Demonstrating and prototyping indirect prompt injection defenses where the attack lives in fetched data, not the user message.
Where to read: Hosein-Abdollahi/mcp-injection-guard.
Design note: Honest tradeoff documented upstream — legitimate “act on fetched data” flows may need human confirmation rather than a hard block.
7. Snyk Agent Scan (supply-chain audit for skills & MCP)
What it does: Discovers locally installed agent skills, MCP servers, and hooks; scans for prompt injection in instructions, malicious code patterns, credential handling, tool poisoning, and related issue codes. CLI + optional cloud analysis; SARIF-friendly for CI.
When to use: Before adding a marketplace SKILL.md, cloning an agent-skills repo, or onboarding a new MCP server from the internet.
Where to read: snyk/agent-scan · risk catalog.
Design note: Static analysis is a first line of defense — combine with sandboxing and network monitoring for anything that runs with shell access.
How to assemble a minimal stack
| Layer | Question it answers | Examples above |
|---|---|---|
| Ingress | Is this text safe in context? | #1 Prompt Injection Firewall |
| Surface | Is this page safe to click? | #2 Deceptive UI Guard |
| Egress | Are we leaking PII to the model? | #3 PII Masker |
| Protocol | Are MCP tools trustworthy at runtime? | #4 MCP-Guard, #5 Shrike |
| Provenance | Did untrusted data author this action? | #6 MCP Injection Guard |
| Supply chain | Should we install this skill at all? | #7 Snyk Agent Scan |
No stack removes the need for constitution (hard limits in tool manifests), approval gates (send email / spend money / sign tx), and logging. Agents that can affect reality should fail closed when a gate refuses — not argue their way past it.
Closing
The agent era copied the app era’s mistake: we shipped capability first and treated safety as documentation. Skills and MCP tools are installable know-how; they deserve the same scrutiny we give npm packages and Terraform modules.
Start with one ingress scanner and one supply-chain audit on anything you did not write. Add surface and provenance guards when your agent gets a browser or outbound tools. Your future incident response team will consider that boring — which is the point.
Top comments (0)