Review tool registry

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — LLM01/LLM06 Excessive Agency

   R05 — MITRE ATLAS

   R21 — MCP tool boundaries

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit P1 tool registry, per-tool authorization, Pydantic schemas, timeouts, retries, and step budgets. Complete `C1` (Autonomous task execution with human approval): generate parameter-bound action previews for sensitive tools, require explicit user approval, and emit D11 trajectory ledger events.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Run direct and indirect prompt-injection attacks attempting to bypass C1 approval gates or tamper with approved tool parameters (TOCTOU).

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   P1 tool-authorization and C1 approval-binding negative test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsModel Context Protocol · spec section
  Security Best Practices

  Specifies token audience separation, confused-deputy and SSRF risks, and least-privilege scope models for MCP servers — the normative basis for per-tool authorization in the P1 registry.

  R21moved 2026-11-11
• videoNeuralNine
  Model Context Protocol (MCP): Everything You Need To Know

  Builds an MCP server in Python and shows the client/server lifecycle and tool exposure, making the trust boundary between host and server concrete before you audit it.

  R21checked 2026-11-11
• videoBugBytes
  MCP Core Concepts - Resources, Tools, Prompts & Transports!

  Separates resources, tools, prompts, and transports, which is the distinction that determines whether a capability needs an argument schema, a timeout, and an approval gate in the tool registry.

  R21checked 2026-11-11
• articleOWASP · cheat sheet
  MCP Security - OWASP Cheat Sheet Series

  Covers tool poisoning, rug pulls, cross-server shadowing, and consent re-prompting on definition change — the exact registry-integrity controls behind parameter-bound action previews.

  R21R04checked 2026-11-11
• repoOWASP (GitHub) · testing guide
  OWASP MCP Security Testing Guide

  Gives per-threat test procedures including a tool-poisoning sequence diagram from tools/list through model context, so the audit produces reproducible test IDs rather than opinions.

  R21R05checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.