{"slug": "your-agent-has-tools-now-why-mcp-tool-calls-need-runtime-verification", "title": "Your Agent Has Tools Now: Why MCP Tool Calls Need Runtime Verification", "summary": "A developer warns that Model Context Protocol (MCP) tool calls in AI agents introduce new security risks, including remote code execution, SSRF, credential exfiltration, and prompt injection. Static configuration scanning is insufficient; runtime verification is needed to assess the safety of each specific tool call based on context.", "body_md": "For most of the short history of LLM applications, model risk was *text* risk. A model could output bad advice, leak something from its prompt, or produce a convincing phishing draft — but it couldn't touch your machine. The worst case ended at the screen.\n\nWire a few tools into that model — a shell, an HTTP fetcher, a filesystem client, a cloud SDK — and the equation changes. With the [Model Context Protocol](https://modelcontextprotocol.io), agents don't just *suggest* operations anymore; they *perform* them, with your credentials, on your infrastructure. The attack surface moves from \"text the model wrote\" to \"actions the model took.\" A prompt that used to produce a paragraph can now produce a process.\n\nIf you're shipping agents with tool access, configuration hygiene is necessary but not sufficient. Here's why, and what runtime verification adds.\n\nThe abuse patterns below are well-known categories — described generically, without reference to any specific project's incidents.\n\n**1. Code execution tools → remote code execution.** Shell, `exec`\n\n, and interpreter tools exist because agents genuinely need them: running tests, scaffolding projects, transforming data. But any string that reaches a shell is a command. Content fetched from a web page, a filename, an error message, or a dependency's metadata can carry shell metacharacters. The model doesn't need to be \"hacked\" in the classic sense — it just needs to faithfully pass attacker-influenced text into an execution tool.\n\n**2. Fetch / HTTP tools → SSRF.** Agents love to fetch URLs: docs, APIs, \"read this link the user pasted.\" A URL is also a network destination. Point a fetcher at a cloud metadata endpoint (`169.254.169.254`\n\n), a private RFC1918 address, or `localhost:port`\n\nand the agent becomes an SSRF primitive — reading internal services from inside your network perimeter and helpfully summarizing what it found.\n\n**3. Credential and environment-variable exfiltration.** Agent processes inherit environment: `AWS_*`\n\n, `GITHUB_TOKEN`\n\n, database URLs, API keys. Tools often accept arbitrary key/value or arguments. A two-step chain — *read* a sensitive file or env var, then *POST* it somewhere via the HTTP tool — turns a \"helpful agent\" into an exfiltration channel. Neither step looks dramatic on its own.\n\n**4. Prompt injection → unauthorized tool calls.** Untrusted content in the model's context (a web page, an email, a file, a tool result) can contain instructions aimed at the model. The model is the one holding the tool handles, and it can't always tell your instructions apart from instructions embedded in data. The outcome is a tool call you never authorized, performed with your authority.\n\nScanning your MCP configuration is the right first move. A static scanner catches real, fixable problems: plain-HTTP transports, disabled TLS verification, credentials pasted directly into config JSON, missing timeouts, over-broad permissions, unpinned server versions. The open-source [ correctover-scan](https://www.npmjs.com/package/correctover-scan) runs\n\n`.cursor/mcp.json`\n\n, `claude_desktop_config.json`\n\n, `.claude/mcp.json`\n\n, `mcp.json`\n\n, and a few more.But a config file is static, and the dangerous part is dynamic. Your `mcp.json`\n\nwill never contain the *argument* the model constructs at 3 a.m. — the URL it decided to fetch, the command string it assembled from a tool result, the env var name it placed into an HTTP body. Static analysis answers \"is this setup reasonable?\"; it cannot answer \"is *this specific call* safe?\"\n\nThe tempting shortcut is a keyword blacklist: block calls containing `exec`\n\n, block URLs containing `169.254`\n\n, block arguments containing `AWS_SECRET`\n\n. It doesn't work, because safety is contextual:\n\n`exec()`\n\nas its normal, declared function is `exec()`\n\nstring passed to a shell is Same tokens, different verdicts — because the *tool*, the *caller*, the *arguments*, and the *chain of preceding calls* differ. That judgment has to happen at call time, with the actual arguments in hand.\n\nA runtime verifier sits in front of tool execution and evaluates every call before it runs. For security, five layers matter most:\n\n`payments.send`\n\ncall with `amount`\n\nas a string fails before it reaches the API.Two non-negotiable properties:\n\n**Step 1 — scan your configs locally.** Zero dependencies, no network needed:\n\n```\n# Auto-discovers .cursor/mcp.json, claude_desktop_config.json,\n# .claude/mcp.json, mcp.json and friends in the current directory\nnpx correctover-scan\n\n# Or point it at a file / directory, with SARIF output for CI\nnpx correctover-scan mcp.json -f sarif > report.sarif\nnpx correctover-scan -d ./my-project\n```\n\n**Step 2 — add the runtime verifier as an MCP server.** [ ccs-mcp-server](https://www.npmjs.com/package/ccs-mcp-server) is a zero-dependency stdio MCP server. Drop this into your client config (Claude Desktop, Cursor, or any other stdio-compatible MCP client):\n\n```\n{\n  \"mcpServers\": {\n    \"ccs-runtime-evidence\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"ccs-mcp-server\"]\n    }\n  }\n}\n```\n\nIt exposes `verify_tool_call`\n\n(the checks above, blocking unsafe calls by default), `issue_evidence`\n\n(Ed25519-signed receipts for every decision, allow *and* deny), and config-audit and receipt-verification tools. The signing keypair is generated automatically on first run; set the `CCS_KEY_DIR`\n\nenvironment variable only if you want to control where it persists.\n\n**Step 3 — wrap an existing server (optional).** If you'd rather verify calls transparently around a server you already run, the compatibility package forwards to the verification gateway:\n\n```\nnpx -y correctover-mcp-server --stdio -- npx -y <your-existing-mcp-server>\n```\n\nBoth servers are published in the official [MCP Registry](https://registry.modelcontextprotocol.io/) as `io.github.Correctover/ccs`\n\nand `io.github.Correctover/mcp`\n\n.\n\nThe evidence model behind these tools is documented in the CCS protocol specification, [draft-correctover-ccs](https://datatracker.ietf.org/doc/draft-correctover-ccs/), which defines the receipt schema, cryptographic bindings (request, parameters, runtime context, issuer, audience, freshness), fail-closed transport requirements, and conformance levels for evidence propagation across agent chains. **This is an individual Internet-Draft, not an RFC or IETF endorsement.**\n\nEverything lives at [github.com/Correctover](https://github.com/Correctover). If you're building agents with tool access:\n\n`npx correctover-scan`\n\nin your repo and in CI — it takes seconds and needs no credentials.Agents that can act are agents that can err at machine speed. Verify the call before it becomes the action.\n\n*Alternative titles:*", "url": "https://wpnews.pro/news/your-agent-has-tools-now-why-mcp-tool-calls-need-runtime-verification", "canonical_source": "https://dev.to/correctover/your-agent-has-tools-now-why-mcp-tool-calls-need-runtime-verification-53i6", "published_at": "2026-09-02 04:01:34+00:00", "updated_at": "2026-09-02 04:24:28.968458+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "ai-infrastructure"], "entities": ["Model Context Protocol", "correctover-scan"], "alternates": {"html": "https://wpnews.pro/news/your-agent-has-tools-now-why-mcp-tool-calls-need-runtime-verification", "markdown": "https://wpnews.pro/news/your-agent-has-tools-now-why-mcp-tool-calls-need-runtime-verification.md", "text": "https://wpnews.pro/news/your-agent-has-tools-now-why-mcp-tool-calls-need-runtime-verification.txt", "jsonld": "https://wpnews.pro/news/your-agent-has-tools-now-why-mcp-tool-calls-need-runtime-verification.jsonld"}}