Agentic Security & MCP Tool Poisoning

When: Agent authorization Weeks 5--6. Build MCP only after ordinary tool authorization works.

• MCP client/server roles, tool discovery, schemas, transports, authentication, authorization, and trust boundaries.

• JSON-RPC message validation and safe error handling.

• Tool poisoning: misleading tool descriptions/metadata that manipulate model tool selection.

• Shadow/conflicting tools and unexpected tool changes.

• Least-privilege scopes, confused-deputy risk, cancellation, timeouts, rate limits, audit events, and safe tool-output handling.

Core practice: the agent may request a tool, but the server independently checks the authenticated principal, tenant, permission, resource ownership, and allowed arguments.

Extra practice: implement a local MCP server with one or two safe tools. Validate with Pydantic, authenticate the client, enforce per-tool scopes, and test malicious descriptions, conflicting names, unauthorized admin-tool requests, malformed JSON-RPC, and cancellation.

Do not learn yet: publishing a public MCP server, supporting every transport, or building an agent-to-agent network. First prove one local server is secure.