Pre-execution tool-call gate and pinned capability catalog.
Topic hub
Agent and MCP security.
Agent and MCP security on Kubernetes is the control plane around tool-using systems: mcp security best practices for identity and egress, the owasp top 10 agentic applications mapped to cluster controls, and an ai agent audit trail for every tool call.
01
Coverage
What this hub covers.
Securing AI agents and MCP servers on Kubernetes: OWASP Agentic Top 10 controls, fail-closed tool-call gates, identity, egress and audit trails.
Workload identity and no token passthrough.
Egress control and sandboxing for tool execution.
Approvals bound to exact arguments.
Audit trail per tool call.
02
Guides
Related guides.
MCP Security Checklist for Kubernetes
A practical MCP security checklist for agents on Kubernetes: identity, token audience, tool pinning, egress, sandboxing, approvals and audit evidence.
OWASP Agentic Top 10 Mapped to Kubernetes Controls
Each risk in the OWASP Top 10 for Agentic Applications mapped to Kubernetes controls you can enforce: identity, admission, egress, sandboxing, audit.
AI Agent Audit Trail: What to Log for Every Tool Call
What an AI agent audit trail must record for each tool call: identity, policy version, verdict, approval, arguments digest, outcome, cost, trace IDs.
03
Related cases
Evidence nearby.
Agent Security Contract
Agent and MCP stacks expand the attack surface beyond prompt text: tool misuse, poisoned tool descriptions, argument injection, and unapproved high-impact actions run without a pre-execution gate
0 false-ALLOW · 0 false-BLOCK on this corpus
Policy as Code Guardrails
Security and platform rules are often discovered only after deployment or during reviews
Standards enforced in CI, not slides
Zero Trust Service Mesh
Internal traffic is often trusted by default, making lateral movement and policy gaps hard to see
East-west mTLS by default
AI Runtime Platform
AI workloads often start as API calls but become production systems that need identity, policy, scaling, telemetry, and clear ownership
Every model call: policy + trace + budget
04
Related hubs
Nearby topics.
Available for meaningful infrastructure conversations