Decide for one task and one configured system. Bound what the agent can read, change and trigger; then test whether its controls survive production-shaped failures.
Complete the stages in order. Task completion cannot compensate for unauthorized access, an unsafe side effect or a missing recovery path.
Name the task, repositories, tools, credentials and environments the agent may reach. Start read-only and expand authority only when local evidence justifies it.
Review repository access →Treat tool descriptions, retrieved content and remote metadata as untrusted. Enforce identity, authorization, network and approval policy outside the model.
Review an MCP connection →Evaluate the configured agent on representative work, prohibited actions, recovery, intervention and rollback—not only task completion or a public leaderboard.
Build a production-shaped evaluation →This sequence is AccessAllGPT editorial guidance, not an empirically validated agent maturity model, security certification or vendor ranking. The linked guides label primary evidence, vendor-authored guidance and AccessAllGPT recommendations, and preserve their limitations and retrieval details.
No agent, protocol, benchmark or deployment is endorsed here. Teams must test the exact model, tools, permissions and controls they intend to operate, verify current product terms and set stop conditions for their own threat model and regulatory context.
Read publication disclosures →Published only when the available evidence can support a concrete technical decision.
AgentCore Evaluations scores sampled behavior while AWS DevOps Agent investigates infrastructure failures—but neither replaces inline controls or human validation
AWS published an open-source multi-agent monitoring architecture on September 11, 2026. It separates agent-quality signals from infrastructure diagnosis and exposes the cost and coverage trade-offs teams must set explicitly.
Three runtimes chose the last value while a first-match tool preview showed the first
A five-case local audit found Node, Python and Ruby all retained the final duplicate JSON member. In one tool call, a preview showed /workspace/readme.md while execution received /workspace/secrets.env.
A hands-on audit of Funes 1.3.0, its secret egress gate, raw-trace retrieval and a two-task launch benchmark
Funes 1.3.0 preserved a useful decision and an explicit instruction injection in the same local memory, then returned both verbatim. That is faithful recall working as designed—and the reason teams must keep authority outside memory.
SDK 1.30.0 reported zero milliseconds but its demonstration store scheduled no cleanup
Two clean SDK 1.30.0 runs kept ttl: 0 tasks visible after 79–80 ms, expired ttl: -10 tasks in 2.0–2.5 ms, and restarted an 80 ms retention clock when a synthetic agent result completed.
SDK 1.30.0 accepted a zero-millisecond hint and delayed abort behind a server-selected sleep
Two clean SDK 1.30.0 runs turned one synthetic 125 ms inference task into 86–88 tasks/get calls when the server returned pollInterval: 0. A 300 ms hint also kept the client stream pending about 262 ms after its agent budget aborted.
SDK 1.30.0 ended local polling and emitted request cancellations, but the synthetic durable job kept running until an explicit tasks/cancel
In two clean SDK 1.30.0 runs, an AbortSignal ended the local task stream without sending tasks/cancel. The synthetic embedding worker advanced for another 75 ms and still reported working; explicit cancellation transitioned it to cancelled and stopped the counter.
SDK 1.30.0 returned a generic -32603 and skipped tasks/result; the same stored retry detail remained retrievable by a direct request
A clean MCP TypeScript SDK 1.30.0 fixture reached failed status, then automatic streaming stopped without fetching the stored result. A manual tasks/result call recovered isError content and retry-after detail that the agent path never saw.
SDK 1.30.0 delivered nine syntactically valid URLs to the client handler—including javascript:, file:, data:, loopback HTTP, embedded credentials and Punycode
The official client enforced URL-mode capability negotiation and rejected malformed syntax, but did not choose which schemes or destinations an AI host may offer to a user. A clean transport fixture shows why consent must come after client-owned URL policy.
Fourteen fast polls ran past a 120 ms task TTL and a 40 ms request timeout; only an explicit outer AbortSignal stopped the loop
In MCP TypeScript SDK 1.30.0, timeout bounded each tasks/get request—not the whole task. Prompt working responses kept automatic polling alive until an outer abort, which also emitted cancellation notifications for every completed poll request still attached to that signal.
SDK 1.30.0 noticed one broken response leg in milliseconds, but four requests settled only at their 300 ms or 900 ms protocol deadline
In an official MCP TypeScript SDK 1.30.0 probe, POST-scoped SSE error and clean-EOF responses both left ping pending until its configured timeout. Doubling the deadline tripled the wait. The JSON control resolved immediately; timeout—not response-leg loss—triggered cancellation.
SDK 1.30.0 stored the task output, then rejected getTaskResult when its documented optional schema was omitted
In an official MCP TypeScript SDK 1.30.0 probe, a synthetic agent task completed and stored its output. getTaskResult(taskId) rejected with a Zod TypeError; passing CallToolResultSchema returned the same result. Contrary to the issue’s stronger failure description, the awaited promise was catchable in this run.
A repeated opaque cursor stopped automatic discovery before page three—and the returned aggregate carried no warning
In a three-page @modelcontextprotocol/client 2.0.0 probe, repeating a valid empty-string cursor made listTools return alpha and beta, omit gamma, delete nextCursor and throw no error. Unique cursors completed; a nonconverging unique sequence failed loudly at listMaxPages.
After two tool-list pages, the TypeScript v1 client validated page two—but accepted bad structured output from page one
In a two-page MCP TypeScript SDK 1.30.0 probe, each listTools response replaced the output-validator cache. After complete traversal, the first-page tool accepted a string where its schema required an integer; the second-page tool failed closed.
The TypeScript client rejected a bad structured result after listTools—but accepted it before the schema cache existed
In an official MCP TypeScript SDK 1.30.0 probe, Client.callTool accepted a string where a tool promised an integer until listTools populated the output-validator cache. Discovery order is therefore part of the client’s validation boundary.
Tool annotations describe intent; trusted code must still authorize effects
In an official MCP TypeScript SDK 1.30.0 probe, a tool advertised readOnlyHint: true and idempotentHint: true, then wrote a file on both calls. The SDK faithfully transported the hints and faithfully dispatched the mutations.
Lifecycle suppression and executable linking are different controls
In npm 11.6.0, a synthetic package installed by npm ci --ignore-scripts did not run its install hook, but npm still created node_modules/.bin/aag-ci-probe. Invoking that link executed the package. --bin-links=false removed the shim, not the underlying executable file.
A clean install can become code execution when a later rebuild drops the flag
In npm 11.6.0, I installed a synthetic tarball with --ignore-scripts and observed no hooks. A later ordinary npm rebuild ran its preinstall, install and postinstall scripts. The install flag did not persist as package approval state; script policy must cover every later build command.
A local reproduction of the difference between “do not write the tarball” and “do not run code”
In npm 11.6.0, a synthetic package’s prepack, prepare and postpack hooks all ran under npm pack --dry-run. The tarball file was not written, but the scripts changed the working tree. Use --ignore-scripts and an isolated builder when inspection must not grant package code authority.
Source-level evidence for pinning lifecycle-script authority to package versions
pnpm 11.24.0 blocks unapproved dependency builds, but its normal approve-builds flow records a bare package name. The pinned implementation treats that name as approval for every registry version. Exact name@version rules are supported and give CI a narrower execution boundary.
A clean-room probe of allowScripts, allow-git and the temporary-clone build path
npm 12.0.2 correctly rejected a git dependency until I enabled git fetching. After that, an unapproved prepare hook still ran twice inside npm’s temporary clone even while npm warned that the package’s prepare script had been blocked. The implementation explains why --ignore-scripts remains the stronger boundary for untrusted git dependencies.
Lifecycle hooks turn dependency installation into shell execution
A local file dependency with preinstall, install and postinstall hooks ran all three hooks during npm install in my sandbox. Re-running with --ignore-scripts suppressed the hooks entirely, which makes the real question obvious: who gets to execute code during installation?
A deployment decision for local servers, relays and downstream resources
If an MCP server can relay the same bearer token it received, the server becomes part of the authorization plane. The safer pattern is audience-bound resource tokens, explicit resource metadata and a refusal to treat localhost as the trust boundary.
Node 26.7.0 adds audit mode, but the security boundary still lives outside the runtime
Node’s stable permission model still catches accidental filesystem and process access, and v26.7.0’s new --permission-audit mode is useful for rollout rehearsals. Our local probe showed the same diagnostics-channel event in both modes; only enforce mode denied the read.
A security decision for RAG, agents and tool-using AI systems
Treat direct and indirect prompt injection as an authority-design problem. Decide whether to deploy, constrain or reject an LLM workflow with explicit data, tool, approval and evaluation gates.
A production-readiness framework for engineering leaders
A coding agent should earn autonomy through controls and repeatable evidence—not through an impressive demo. This framework turns repository access into a staged engineering decision.
A go/no-go review for tool access, identity and containment
MCP standardizes how an AI application reaches tools; it does not decide which authority the application should receive. Use these gates before a server can touch production data or actions.