Solutions / MCP security
Trust the tools your agents call.
MCP turns a model into an actor with hands. Cerberus instruments every tool call, so a poisoned tool or a runaway agent shows up the moment its behavior diverges from its task.
quarantine agentblockalertIllustrative product interface. The figures shown are an example of how Cerberus presents a detection, not benchmark or performance results.
Tool poisoning
A manipulated tool definition steers an agent into calls it never intended.
Excessive agency
Agents reach far beyond their task, with real credentials behind every call.
No audit trail
Tool calls happen inside the model loop, invisible to a network WAF.
How it works
The call graph gives it away.
When the plan says invoices and the calls reach for secrets, the divergence is the alert.
Coverage
What Cerberus catches here.
Tool poisoning
Malicious or manipulated tool definitions steering agent behavior.
Prompt injection to action
Injected instructions that turn into real, harmful tool calls.
Excessive agency
Scope drift where an agent acts well beyond its declared task.
Data exfiltration via tools
Sensitive reads chained into outbound calls. The chain is the anomaly.
Shadow MCP servers
Undocumented tool endpoints discovered across your surface.
Confused deputy
An agent tricked into using its privileges on an attacker's behalf.
FAQ
Common questions
What is MCP tool poisoning?
Tool poisoning is manipulation of an MCP tool's metadata, its name, description, or parameter hints, so that an agent invokes it toward a purpose the user never asked for. The agent behaves correctly given what it was told the tool does. Because the deception lives in the tool definition rather than in the request, nothing in the traffic looks malformed, which is why payload inspection does not catch it.
How do I secure MCP servers and agent tool calls?
Treat every tool call as an authenticated action that needs its own authorization decision, made outside the model that may have been injected. In practice that means scoping each agent to specific tools, using short-lived credentials, validating tool schemas on registration and on change, and comparing what an agent set out to do against what it actually calls. Cerberus instruments the tool boundary so that comparison runs on real calls rather than on a spec.
Which OWASP risks does this cover?
Primarily Agent Goal Hijacking (ASI01) from the OWASP Top 10 for Agentic Applications 2026, which ranks first, along with excessive agency and tool misuse. Prompt injection that turns into a real tool call spans both the agentic list and LLM01. Runaway tool loops that burn spend fall under LLM10:2025 Unbounded Consumption.
Can you detect a poisoned tool without inspecting the model's reasoning?
Yes, and that is the point. Model reasoning is often unavailable and always untrustworthy once injected. Cerberus scores the observable layer instead: the declared plan, the sequence of tool calls, the parameters and their provenance, and where data ends up. A poisoned tool shows itself when the call graph diverges from the task, regardless of what the model was thinking.
Ship agents. Keep the trust.
See Cerberus read your own traffic, human and agentic, in one walkthrough tailored to your stack.