Inside the 7-Step Tool-Call Security Pipeline
Every time one of your AI agents invokes a tool over MCP, G8KEPR intercepts that tools/call and runs it through a seven-step security pipeline. Checks run before, during, and after the tool executes — each can block, redact, or flag the call — so a poisoned or tampered call is caught before the tool runs and injected instructions in a result are caught before they reach your agent.
Why a pipeline
MCP tool calls are the new attack surface for AI agents: tool-poisoning, rug-pulls (a tool that changes after you approved it), and indirect injection hidden inside a tool's own output. G8KEPR sits inline at the tool-call layer and enforces these controls on every request rather than trusting a one-time approval prompt.
The pipeline is deterministic where it matters. Integrity and policy checks are cryptographic and rule-based, not probabilistic, so an attacker can't simply talk their way past them.
The seven checks
- 1.Authenticate and scope. The call is tied to a verified organization and user. Identity is taken from the signed session, never from client-supplied fields, and per-org rate limits are applied.
- 2.Screen the request. The tool name and its arguments are scanned for known injection and tool-poisoning patterns before anything is trusted.
- 3.Verify tool integrity (rug-pull check). The tool's full definition — name, description, parameters, and schema — is fingerprinted and compared against the fingerprint captured when you approved it. Any change blocks the call and requires re-approval.
- 4.Enforce policy and permissions. The call is checked against your access rules: is this tool approved, and is the caller allowed to use it for this resource?
- 5.Execute in a sandbox. Tools G8KEPR runs directly are executed in an isolated environment with resource limits and restricted network access, and are terminated if they time out or exceed their limits.
- 6.Inspect the output. The tool's response is scanned for indirect prompt injection — instructions smuggled back through tool output — before it is returned to your agent.
- 7.Log and alert. The decision is written to a durable audit trail, and anything blocked fires a high-severity event.
A legitimate tool update changes its fingerprint and will be blocked at step 3 by design. This is re-consent, not a bug — re-approve the tool to resume calls.