---

archetype: ai-agent-mcp

primary_gate_families: [1, 7, 3]

---

# Archetype - AI Agents, Tool-Runners & MCP Servers

Targets: Open WebUI, Flowise, n8n, LangChain/LangGraph tool execution, LlamaIndex, AutoGPT-likes,

and the explosion of **MCP servers**. The thesis: these systems exist to **turn model output into

actions** - they run tools, eval code, fetch URLs, query DBs, exec shell. The whole product *is* a

chain of trust-boundary crossings, and the field is months old, so the parsers, sandboxes, and

allowlists are immature. This is a [[../00-doctrine/SEVERITY-GATE#family-1-remote-code-execution-the-crown|Family 1]] / [[../00-doctrine/SEVERITY-GATE#family-7-ssrf-xxe-file-access-chains-to-critical|Family 7]] / [[../00-doctrine/SEVERITY-GATE#family-3-cloud-identity-account-takeover-privilege-escalation|Family 3]] archetype.

See: [[ml-model-loaders]] (inference backends behind these), [[devops-infra]] (often self-hosted),

[[electron-desktop]] (desktop AI clients). Tooling: `test_mcp_server`, `mcp_tool_surface`,

`test_ssrf_params`, `test_cmdi`, `test_ssti`.

---

## Principals & trust boundaries

- **Principals:** the end user / prompt author, the **model** (untrusted output - treat model text as

  attacker-controlled), tool/plugin authors, the **MCP server** author, connected data sources

  (a fetched webpage, a RAG document, an email the agent reads), the host process and its credentials

  (API keys, cloud creds, DB creds the agent holds).

- **Core boundaries:**

  1. *Prompt / fetched content → model* (prompt injection; content the agent reads is attacker input).

  2. *Model output → tool dispatcher* (the model's chosen tool + args drive real actions).

  3. *Tool → OS / network / DB* (code-exec tools, HTTP-fetch tools, DB tools).

  4. *MCP client ↔ MCP server* (tool definitions and results cross a process/network boundary -

     **tool-poisoning**: a malicious tool *description* manipulates the calling agent).

- **The defining insight:** in an agent, **untrusted data and the control plane share a channel**.

  A RAG document or a fetched page can contain instructions the model obeys → the model calls a

  dangerous tool → real impact. Prompt injection is the *delivery*; the *finding* is the tool-abuse it

  reaches.

**Boundary map template:**

```

principals:        prompt-author | model-output(untrusted) | tool-author | MCP-server | fetched-content | host-creds

trust inputs:      user prompt, RAG docs, fetched URLs/pages, email/file the agent ingests,

                   tool definitions (name/description/schema), MCP server responses, workflow JSON

enforcement pts:   tool allowlist, code-exec sandbox, URL/SSRF allowlist, auth on the agent's own

                   HTTP API, per-tool permission scoping, output filtering

cross-boundary

sinks:             code-interpreter tool (exec/eval/PythonREPL) ; shell tool ; HTTP-fetch tool ;

                   SQL tool ; file tool ; the agent server's own unauth endpoints ; SSRF in the

                   model-provider/proxy config ; secret-returning tool reachable by prompt

confusion

hypotheses:        "the code-exec sandbox is escapable / isn't really sandboxed";

                   "a poisoned tool description redirects the agent to a dangerous tool";

                   "the HTTP API has unauthenticated admin/exec routes";

                   "SSRF allowlist misses an internal scheme / metadata IP";

                   "prompt injection in a RAG doc reaches the shell tool"

```

---

## Kill chains (each lands on a Gate family)

### KC-1 - Unauthenticated server endpoints → RCE (Family 1) *(check this FIRST)*

These products are *self-hosted web apps*, and many ship with weak/optional auth or unauth admin/exec

routes. Before any prompt-injection cleverness, hunt the **HTTP surface** of the agent server itself.

- **Sinks:** Flowise/n8n/Open WebUI routes that import workflows, run code nodes, set up credentials,

  or hit `/api/v1/...` without auth; n8n's `Code`/`Function` node and Webhook→exec paths; LangServe

  endpoints exposing tools without auth.

- **CVE class:** the 2024 Flowise auth-bypass (unauth API via case/route-normalization), n8n code-node

  RCE class, Open WebUI path issues. Find the *new* unauth route or the *next* normalization bypass.

- **Oracle:** an unauthenticated request lands command output / callback → Family 1.

### KC-2 - Prompt injection → dangerous-tool dispatch → RCE / exfil (Family 1 / 7)

A RAG document, fetched webpage, or ingested file carries instructions; the model obeys and calls a

**code-interpreter / shell / file / HTTP tool** with attacker args.

- **Sinks:** `PythonREPLTool`, `exec`/`eval` in a code-interpreter, `ShellTool`/`Terminal` tool,

  `requests`/`httpx` in a fetch tool (→ SSRF), file-read tools, DB tools (→ SQLi/exfil).

- **The discipline:** the *finding* is not "the model can be prompt-injected" (that's the threat

  model). The finding is the **artifact at the end of the tool call** - a callback from the code tool,

  a secret read, a cross-tenant action. Prompt injection that reaches a *harmless* tool is cleared-axes.

- **Oracle:** injected content causes the code/shell tool to fire our canary → Family 1; or the fetch

  tool to hit metadata and *capture the credential* → Family 7/3.

### KC-3 - Code-exec sandbox escape (Family 1/2)

Many agents wrap the code tool in a "sandbox" (a subprocess, a restricted Python, a container). The

sandboxes are usually weak. Escaping one is a clean Family 1 (and Family 2 if it's a container).

- **Sinks:** the restricted-exec wrapper (RestrictedPython, `ast` allowlists, a thin subprocess

  jail), the container the code runs in (then [[devops-infra]]/Family 2 escape mechanics).

- **Oracle:** code that breaks out of the restricted env reaches the real OS / host → callback.

### KC-4 - MCP tool-poisoning & SSRF→RCE (Family 1/7)

MCP servers expose tools to a calling agent via tool *definitions*. A malicious/compromised MCP server

can ship a tool whose **description** contains injection (the agent reads descriptions), or whose

**implementation** does SSRF/command-injection on the args the agent passes.

- **Sinks:** the MCP server's tool handlers (`test_mcp_server` / `mcp_tool_surface` to enumerate),

  any handler doing `exec`/HTTP-fetch/file-access on tool args; the tool-description channel as an

  injection vector into the *client*.

- **Oracle:** a tool call lands command exec on the server (Family 1) or SSRF→metadata (Family 7/3).

### KC-5 - Agent-held credential exfil & cross-tenant (Family 3/4)

Agents hold powerful secrets (model-provider keys, cloud creds, DB creds, OAuth tokens). A prompt

injection or a tool flaw that *returns those secrets* or *acts cross-tenant* is Family 3/4.

- **Sinks:** any tool/endpoint that can read the agent's env/config/credential store; multi-tenant

  agent platforms where one tenant's prompt reaches another tenant's tools/data.

- **Oracle:** the secret retrieved + minimally validated (Family 4), or tenant-A session producing

  tenant-B canary (Family 3).

---

## The dynamic oracle, concretely

1. Self-host the target in a disposable container (`sandbox_create`) with **planted canary secrets and

   a second canary tenant**. Pin version.

2. Map the HTTP surface first (`discover_api_endpoints`, `test_unauth_access`) - unauth RCE beats

   clever injection every time.

3. For injection chains: feed a malicious RAG doc / fetched page / tool, and watch the *tool sinks*,

   not the model's words. The proof is the callback / secret / cross-tenant canary - never the model

   *saying* it will comply.

4. REPLICA_CONFIRMED on the artifact; LIVE_CANARY only in scope.

---

## BORING traps - do NOT spend time here

- **"The model can be jailbroken / prompt-injected."** That is the threat model, universally true,

  and not a finding. The finding is the *tool-abuse artifact* it produces. A jailbreak with no

  dangerous sink is cleared-axes.

- **"The agent followed instructions in a document."** Same - only counts if it reached a gate sink.

- **Prompt-injection that makes the model say something bad / leak its system prompt.** System-prompt

  leak and "harmful text" are not [[../00-doctrine/SEVERITY-GATE|gate]] families. Hardening note.

- **Hallucinated tool calls with no real effect.** No artifact, no finding.

- **A code-interpreter that is *documented* as full-RCE-by-design and gated behind auth.** If it's an

  intended authed feature, running code in it isn't a bug - the finding is the *unauth* or *escape*.

- **Re-finding the public Flowise/n8n CVE on an old build.** Sibling-CVE; hunt fresh code.