Skip to main content
On this page

MCP security best practices

The Model Context Protocol gives AI agents direct access to your business data and operational workflows. The etg24 platform provides architectural guardrails to ensure agents operate safely and predictably within defined boundaries.

1. Start with read-only scopes

Agents that evaluate tickets, summarize documents, or generate portfolio reports should always operate with a read-only API key. A read-only key can execute any query tool, but is rejected at the protocol level if it attempts to execute a command tool. Only grant write permissions when an agent’s explicit purpose requires state changes. Learn more in Permission scopes.

2. Dedicated credentials per agent

Do not share API keys across multiple automated agents. When every agent has its own credential:

  • Its actions are uniquely identified in the Audit trail & change attribution.
  • If an agent malfunctions, you can disable that single credential instantly without impacting other systems.

3. Restrict destructive command tools

Before deploying autonomous agents, verify whether they require destructive capabilities (deletions). On etg24, destructive operations are gated behind an isolated delete scope. Agents handling customer-facing inboxes or external communications should never hold destructive scopes.

4. Comprehensive audit visibility

Every tool call executed via MCP — whether query or command — produces an attributable event. The audit trail captures the tool name, input arguments, executed changes, and exact timestamp.

5. Reversible state mutations

If an autonomous agent makes a mistake or processes corrupted input, follow our recovery workflow: identify the event in the audit trail, disable the key if needed, and execute a restore command. Thanks to Soft delete & rollback, deleted records are restored without data loss.

6. Treat external prompt content as untrusted input

Any external data processed by an agent — tenant emails, contact forms, or uploaded documents — can contain prompt injections or hostile instructions. Follow defensive architecture:

  • Keep sensitive scopes (accounting, contract deletion) completely isolated from agents that read inbound customer messages.
  • Require human-in-the-loop approval before executing high-impact commands.

Pre-deployment security checklist

  • Is the agent configured with a read-only key unless write permissions are strictly necessary?
  • Does the agent operate with a unique, purpose-named key?
  • Are destructive scopes withheld from agents processing untrusted external inputs?
  • Have tool schemas and prompt instructions been verified in staging before unattended deployment?
  • Is the recovery runbook understood: Change Log → Key Revocation → Entity Restore?