Fail-closed security contract for AI agents and MCP tool calls: abuse-case corpus, ALLOW / BLOCK / REQUIRE_APPROVAL verdicts in CI, and hash-checked evidence envelopes.
How it works
Agent Security Contract by Andrey Lesnikov — pin a capability policy, evaluate agent and MCP tool-call traces before execution, and ship a CI-grade evidence envelope.
YAML declares the capability catalog, a pinned sha256 capability digest, per-agent tool allowlists, argument constraints, high-impact approval, and rate limits.
asc check (or the HTTP sidecar / GitHub Action) compares the trace to the policy. Malformed policy, digest mismatch, unknown tool, evaluator error, or timeout all return BLOCK.
Verdicts are ALLOW, BLOCK, or REQUIRE_APPROVAL — mapped to OWASP ACS ALLOW / DENY / ASK — with exit codes 0 / 1 / 2 for CI admission.
Each decision writes an evidence envelope (policy_sha256, trace_id, commit_sha, envelope_sha256). asc verify rejects tampering against the integrity digest; envelopes are hash-checked, not signed.
Evidence
How the system is framed, operated, and proven — not a slide deck summary.
Agent and MCP stacks expand the attack surface beyond prompt text: tool misuse, poisoned tool descriptions, argument injection, and unapproved high-impact actions. Without a pre-execution gate, those calls run before anyone can deny them.
ASC is a platform gate: a pinned YAML capability policy plus a tool-call trace feed an evaluator that returns ALLOW, BLOCK, or REQUIRE_APPROVAL. Delivery paths are the asc CLI (check / verify / corpus), an HTTP sidecar with a fail-closed client, and the reusable GitHub Action justrunme/[email protected]. Every verdict emits an evidence envelope with policy SHA-256, trace ID, commit SHA, and an integrity digest.
ASC evaluates static traces and pre-execution hook payloads against a declared policy. It is not a runtime OS sandbox, a prompt-injection detector, a full ACS wire Guardian, or a signer: envelopes carry an unkeyed integrity digest (hash-checked, not signed). Complementary to Promptfoo-style red teaming and ACS Guardians — not a replacement.
Release v0.1.0 on this corpus of 28 scenarios (14 attack, 14 benign): critical false-ALLOW 0, benign false-BLOCK 0/14, corpus passed, suite wall-clock 16 ms (docs/EVIDENCE.md, results/results.json). Scenarios map to OWASP ACS Instrument.toolCallRequest dispositions (ALLOW / DENY / ASK) and OWASP Agentic Top 10 risks (for example ASI01 goal hijack, ASI02 tool misuse, ASI04 MCP tool poisoning). CI run https://github.com/justrunme/agent-security-contract/actions/runs/38871805381. Metrics apply on this corpus only.
Pinned capability digests, ALLOW / BLOCK / REQUIRE_APPROVAL verdicts, fail-closed defaults, OWASP ACS and Agentic Top 10 mapping, and CI-grade evidence envelopes that are hash-checked (not signed).
Related
CVE scanners produce finding counts
Blast radius predicted before CVE count
AI workloads often start as API calls but become production systems that need identity, policy, scaling, telemetry, and clear ownership
Every model call: policy + trace + budget
Security and platform rules are often discovered only after deployment or during reviews
Standards enforced in CI, not slides