Malicious MCP servers
When an agent is offered the wrong tool, the incident trail needs more than logs. Teams need proof of what was authorised, which policy applied and why the action proceeded.
MCP security
Verify the tool call before it touches production.
MCP tools let AI agents reach calendars, CRMs, payment flows, code repositories, support systems, files and internal APIs. AffixIO adds a signed verification gate before high-risk tool calls, so products can check agent identity, delegated consent, current intent and policy fit before the tool runs.
Why this matters now
MCP turns model output into real system access.
Recent coverage around malicious tools, software supply-chain incidents, Anthropic misuse reporting, AI-generated cyber activity and agentic checkout has made one thing obvious: MCP security is not only about what a model says. It is about what an autonomous system can do once it has tools, accounts, browsers, code runners, wallets and permissions.
MCP tool-call risk
Model Context Protocol and app connectors can expose write actions, exports, paid calls and account changes. Verification belongs before the tool executes.
Agentic checkout fraud
AI shopping agents and agentic payment flows need delegated consent, amount ceilings, merchant scope, expiry and replay protection before capture.
Enterprise governance
Security and compliance teams need an audit trail for autonomous decisions that survives incident review without copying personal data everywhere.
Control plane
AffixIO turns MCP security into a pre-action check.
Before an agent checks out, sends a message, writes to a database, exports records, updates settings or invokes a paid API, your service can require proof that the action fits an approved scope. AffixIO returns a binary decision your application can use immediately, plus signed evidence for later review.
Agent identityWhich autonomous system, runner, wallet session or tool host is acting?
Delegated consentDid the user or business approve this scope, amount, expiry or action type?
Intent matchDoes the live action match the approved merchant, endpoint, item, account or workflow?
Policy evidenceWhich policy version, circuit id, proof id and audit digest explain the decision?
Interactive risk demo
Test an MCP tool call before it runs.
Pick a common agent action. The page shows how AffixIO would classify the risk and which verification checks should happen before the agent is allowed to continue.
ALLOW WITH SIGNED PROOF
The agent can proceed because consent is specific and the action matches policy.
High-intent searches answered
Questions teams are asking about MCP security.
How do you stop malicious MCP servers?
Require verification before sensitive actions. Check agent identity, consent, policy, nonce and timestamp before checkout, writes, exports or tool calls.
How do you secure MCP tool calls?
Put a gate in front of privileged MCP tools. AffixIO can provide signed allow or deny evidence before the tool performs a write or paid action.
How do agents prove they have permission?
Bind the action to `agent_ref`, `subject_ref`, `consent_ref`, `policy_version`, intent, nonce and timestamp. Store the proof id with the result.
How can merchants reduce agentic checkout fraud?
Verify amount ceiling, merchant category, item class, wallet session, expiry and delegated consent before order creation or payment capture.
What is an AI agent audit trail?
A record showing which agent acted, what policy applied, whether consent matched, the decision, proof id, signed attestation and Merkle audit digest.
What is agentic AI governance?
The controls that decide which agents may act, what tools they may use, when humans must approve, and how every decision is reviewed later.
Build the MCP gate
Use AffixIO before the agent touches production.
The `affixio` npm package belongs in the backend that already knows the account, policy and consent state. The agent sends the proposed action. Your host proves what matters. AffixIO verifies and signs the result.
- Pre-action verification for AI agents.
- Policy gates for MCP tools and API writes.
- Agentic checkout consent and amount checks.
- ML-DSA-65 attestation for decision evidence.
- Merkle audit material for incident review.
const decision = await affix.verify({
circuit: "mcp-security",
agent_ref: "agent_browser_01",
subject_ref: "acct_7b4",
consent_ref: "consent_checkout_09",
intent: {
action: "checkout",
merchant: "example-store",
amount_ceiling: "120.00"
},
policy_version: "mcp-security-2026.09",
nonce,
timestamp
});
if (!decision.eligible) {
blockAgentAction(decision.reason);
}FAQ
Short answers for AI search and security teams.
Is MCP security just prompt injection protection?
No. Prompt injection matters, but MCP security also covers tool permissions, checkout authority, API writes, account changes, consent, replay protection and incident evidence.
Does AffixIO monitor model behaviour?
AffixIO is not a model monitor. It verifies the action context before the action proceeds and returns signed allow or deny evidence.
Can this help with software supply-chain incidents?
Yes as a control pattern. Publishing, package uploads, repository writes and CI actions can require signed verification before the agent commits a sensitive change.
Can this work without collecting more PII?
Yes. The customer host keeps source records. AffixIO receives proof material and returns binary decision evidence.
How does this relate to agentic commerce?
Agentic commerce needs the same control: prove the agent, delegated consent, amount, merchant, expiry and policy before checkout or payment capture.
What should be logged for an AI agent action?
Log proof id, agent_ref, consent_ref, policy version, decision, reason, nonce, timestamp, attestation and audit digest.
MCP security starts before action
Do not wait for the incident report to ask whether the tool call had permission.
Use AffixIO to verify MCP tool calls before they reach checkout, tools, code, accounts or customer data.