AI Agent Infrastructure & Security
Put AI agents into production without handing them the keys
Agents shipped faster than security review could follow. Most production agents today run on a shared API key, with open egress, and cannot be stopped without a deploy. We fix that: real identity, audience-restricted MCP authorization, purpose-bound tools, containment, and an audit trail that answers “what did it do, and under whose authority?”
The problem
Agent security is genuinely different
An agent's control flow is steered by text it reads. That makes every tool result attacker-influenceable input and every tool a potential action the attacker takes. Prompt instructions are preferences, not boundaries. The controls have to live outside the model.
Indirect prompt injection
A web page, document, or email the agent reads carries instructions. The agent follows them. There is no complete defence, so the consequence has to be bounded.
Confused deputy
A token minted for one MCP server is accepted by another. One shared API key becomes every user's authority. Audience-restricted tokens close it.
Tool poisoning
A third-party MCP server changes a tool description after approval. Without manifest hashing, the rug pull is invisible and free.
Excessive agency
The agent can refund, delete, or email with nothing outside the model checking. Two hundred refunds an hour is an incident even if each one is authorized.
What we deliver
Four engagements, sized to where you are
Start with the assessment if you have agents running and are not sure what they can do. Start with the gateway if you are about to ship your first one.
Agent Security Assessment
We review your agent estate against the threat model above: identity and delegation, MCP authorization, tool design, runtime sandboxing, containment, and observability. You get a prioritised findings report and a 30/60/90-day plan sized to your risk profile, not a generic checklist.
MCP Gateway & Identity Implementation
We put a gateway between your agents and their tools: OAuth 2.1 resource servers, audience-restricted tokens from your existing IdP, workload identity for each agent, purpose-bound tool manifests, and row-level authorization against the delegating user.
Containment & Kill Switch
Budgets, per-tool rate limits, circuit breakers, human approval on irreversible actions, and a kill switch on-call can reach without a deploy. We run the game day with your team so the first time you pull it is not during an incident.
Agent Platform on Kubernetes or Bedrock
Default-deny egress, restricted pod security, blocked metadata endpoints, Gatekeeper policy, and structured audit events shipped to your SIEM. Or the equivalent on Amazon Bedrock Agents with Guardrails and action-group scoping.
How a call flows
Every tool call passes through the same six checks
Nothing in this sequence depends on the model cooperating. That property is what makes it a control rather than a suggestion. It is the architecture we implement for clients and the one our reference implementation ships.
secure-mcp-agent-starter
Apache 2.0A runnable MCP server and gateway in TypeScript with the full control set, unit and end-to-end tests, a hardened Kubernetes deployment, and a twelve-step sample client that shows a poisoned document being stripped, a refund held for human approval, a replayed token rejected, and the kill switch taking effect mid-session.
- 1
Verify
Signature, issuer, audience, and expiry on every request. A token for another server is rejected here.
- 2
Bind
The session belongs to the user who opened it. Another user's token cannot drive it.
- 3
Scope
The tool's required scope must be on the token, and the tool must be in this agent's declared purpose.
- 4
Contain
Kill switch, budgets, PII-then-egress chain break, and a human gate on anything irreversible.
- 5
Execute
The handler enforces row-level authorization against the delegating user, never the agent.
- 6
Audit
One structured event per call: who, on whose behalf, which tool, which content triggered it, and the outcome.
Rollout
Ninety days, largest risk reduction first
You will not implement everything before your first agent ships, and you should not try. This is the order we use, and the assessment tells you which items you actually need.
First 30 days
Bound the worst case
- Per-agent workload identity replaces shared keys
- Every tool classified mutating or not, reversible or not
- Human approval on every irreversible tool
- Default-deny egress on the agent namespace
- Kill switch shipped and tested
Days 30 to 60
Fix authorization
- Audience validation on every MCP server
- Resource indicators from every client, no token passthrough
- Delegated authority for row-level access
- Third-party MCP servers allowlisted and hash-pinned
Days 60 to 90
Detect and refine
- Full tool-call audit trail with content provenance in the SIEM
- Rate limits and circuit breakers tuned to real baselines
- Sequence-level policy against parasitic chains
- Red-team scenarios added to a regression suite
Not sure which of these you need?
The two-week assessment answers that for your specific agents, tools, and risk profile.
Let's build together
Bring us your hardest cloud problem.
Whether you're scaling globally, going production with AI, or trying to claw back cloud spend — book a 30-minute working session with a NubisCore architect.
- 24-hour response
- No-pitch first call
- Senior engineers, not account managers