How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Mend.io has published a practitioner guide called "Securing AI agents, MCP servers and LLM apps: A practical framework" that addresses a real and growing gap: AI agents and integrations are landing in production faster than most security teams can track them. The guide organizes the problem into three moves, maps five distinct attack surface layers, and ships seven reusable artifacts including a 12-point misconfiguration checklist and a maturity self-assessment. It is a useful read for any team shipping AI-powered features right now.

What happened

Item	Detail
Publisher	Mend.io
Guide title	Securing AI agents, MCP servers & LLM apps: A practical framework
Core structure	Three moves, seven reusable artifacts
Attack surface layers	Five: Interaction, Agent, Integration, Model, Code
Misconfiguration checklist	12 points per agent or MCP server
Maturity stages	Four: Emerging, Developing, Controlling, Leading
Self-assessment	15 questions; 0-5 Emerging, 6-10 Developing, 11-13 Controlling, 14-15 Leading
Standards alignment	NIST AI RMF, OWASP AIMA, ISO/IEC 42001, EU AI Act

The guide is organized around three moves: see what matters, fix what matters faster, and protect AI in production. Each move maps to artifacts teams can drop into their existing security workflows.

Why does traditional AppSec break for AI agents?

Conventional application security assumes a program does exactly what its code says. Agentic AI breaks that assumption. An agent’s behavior comes from a combination of the model, a system prompt, retrieved documents, user input, and the tools it can call. Two identical deployments can act differently in production.

The new failure modes do not show up in a CVE feed:

• Prompt injection arrives through data, not code.
• Over-permissioned agents can take harmful actions without any vulnerability being exploited.
• Deprecated models keep serving predictions after their maintainers stop patching them.
• Poisoned tool descriptions on an MCP server (Model Context Protocol, a standard for connecting agents to external tools) can redirect agent behavior without touching the application code at all.

The mandate is two-sided: shift left during development, and protect right in production.

The five-layer attack surface

Mend.io’s first artifact maps risk across five layers:

Layer	What lives there	Key risks
Interaction	User inputs, retrieved documents, inter-agent messages	Prompt injection, context poisoning, data exfiltration
Agent	System prompts, configs, memory, autonomy settings	Over-permissioned tools, unsafe defaults, goal hijacking
Integration	MCP servers, tool definitions, plugins, APIs	Poisoned tool descriptions, unscoped credentials, shadow servers
Model	Foundation and fine-tuned models, embeddings	End-of-life models, supply chain risk, unsafe generations
Code	AI-generated code, frameworks, SDKs	Vulnerable code, framework CVEs, malicious packages

See: finding shadow agents before they find you

According to the guide, agents rarely arrive through procurement. The three categories to hunt are shadow agents, unregistered MCP servers, and embedded AI frameworks. Mend.io recommends five discovery methods:

1. Scan repositories for agentic signatures.
2. Watch network egress for calls to model API endpoints.
3. Audit service accounts and API keys.
4. Make registration cheap with a lightweight declaration process.
5. Automate continuously, since point-in-time scans go stale fast.

The AI-BOM (Bill of Materials) artifact tracks nine fields per agent or MCP server: identity, model dependency, autonomy level, tool permissions, credential scope, data reach, MCP endpoints, prompt location, and last review date.

Fix: prioritizing findings that actually matter

AI-powered tooling expanded the number of findings, not just the attack surface. The guide recommends a three-stage pipeline: enrich, prioritize, triage. Prioritization signals, ranked by value: reachability, exploitability context, business context, agentic amplification, and fix availability.

The automation decision table from the guide:

Finding type	Disposition
Reachability/dataflow, well-understood classes	Automate
FP/TP assessment with evidence trails	Automate, with sampling
Tier-3/high-risk applications	AI-assist, human decides
Novel classes, AI behaviors, no evidence	Human only
Accepting risk or deferring a fix	Human only, documented

One firm rule: every automated closure must carry evidence. If the system cannot show why something is a false positive, it goes to a human. Error rates get sampled review, with thresholds that trigger retraining.

Protect: runtime guardrails and prompt hardening

Runtime protection involves guardrails, prompt hardening, policy enforcement, and monitoring. Guardrails deploy in two ways: as an embedded Python SDK (supporting online or isolated offline modes) or as a standalone Docker API server that requires no code changes or Python dependencies.

A minimal viable setup covers two directions:

• Inbound: catching prompt injections, out-of-policy requests, and jailbreak attempts.
• Outbound: catching credentials, PII, proprietary code, unsafe content, and policy violations.

System prompt hardening follows five patterns: assume disclosure, separate instructions from data, constrain the blast radius, version and review prompts, and test adversarially. The guide is direct on one point: strict permissions beat prompt instructions. Preventing tool access removes the need to instruct an agent not to do something dangerous.

For teams already thinking about AI integration inside their own products, the guardrails architecture here is a practical starting point, not a theoretical checklist.

Why it matters

Most businesses shipping AI features today are focused on capability, not exposure. The attack surface Mend.io maps is real and largely invisible to standard security tooling. A poisoned MCP tool description or an over-permissioned agent with access to your CRM or file system is a genuine business risk, not a theoretical one.

The EU AI Act alignment is also worth noting. Organizations operating in Europe need a compliance story for high-risk AI deployments. Having a documented framework that maps to ISO/IEC 42001 and NIST AI RMF is a head start, not overhead.

If you are curious how other teams have approached tracking AI behavior in production, the broader question of what open-weight AI models mean for business deployments adds useful context on model provenance and EOL risk.

Our take

This is a sponsored guide, and it reads like one in places. But the underlying framework is genuinely solid. The five-layer attack surface map and the automation decision table are worth pulling into any team’s internal documentation, regardless of whether you use Mend.io’s tooling.

The most practical insight is also the simplest: permissions beat prompts. If an agent should not be able to delete records, revoke the permission. Do not write a system prompt telling it not to. That is good engineering advice that applies whether you are building a small internal tool or a customer-facing agent.

The maturity self-assessment (15 questions, four stages) is a useful conversation starter with stakeholders who want to know where their security posture stands. Most teams we speak with would score in the Emerging to Developing range right now, which is honest and fine as a starting point.

If your team wants a structured look at what AI integration risks exist in your current stack, get in touch and we can walk through it.

What to do about it

1. Run the five-discovery scan this week: check repos, network egress, and service accounts for unregistered agents or MCP servers.
2. Build or update your AI-BOM with the nine fields per agent (identity, model, autonomy level, tool permissions, credential scope, data reach, MCP endpoints, prompt location, last review).
3. Work through the 12-point misconfiguration checklist, starting with credential scoping and system prompt version control.
4. Deploy inbound and outbound guardrails using either the Python SDK or the Docker API server, whichever fits your stack.
5. Take the 15-question self-assessment to establish a baseline maturity score before your next security review.

The most common mistake right now is treating AI agent security as a future problem. If agents are already in your codebase, the exposure is present tense.

Source: Marktechpost