Advanced•12–18 hours

Agent Capability Supply-Chain Audit

Audit Agent Skills, plugins, MCP servers, and tool catalogs as an executable capability supply chain covering provenance, install boundaries, schemas, authorization, caching, version drift, and revocation.

AI supply chainMCP securitytool provenanceauthorizationversion controlrevocation

Scenario

Task

An organization connects dozens of MCP servers, Agent Skills, and plugins. The tool catalog changes independently of application releases, local installation can execute commands, and cached metadata can survive redeploys. Prove which capabilities are actually authorized for a specific agent release and how they can be revoked.

Step-by-step execution

1. Build the capability inventory

Outcome: No unknown tool, plugin, or skill dependencies remain in the release.

Tasks

→Collect MCP servers and tools
→Record version, digest, and provenance
→Mark local-install command boundaries
→Classify read, write, egress, and data access

Checks

✓Every capability has an owner
✓A portable package is not trusted merely because of its format

2. Separate protocol access from business authority

Outcome: A valid OAuth or MCP request does not imply permission for a consequential action.

Tasks

→Verify issuer and client binding
→Assign business permission scopes
→Add exact-action approvals
→Set deny-by-default for new tools

Checks

✓A new tool does not receive authority automatically
✓Privilege expansion requires a separate review

3. Run drift and poisoning tests

Outcome: Metadata, schema, or cache changes cannot bypass policy.

Tasks

→Alter the tool description
→Change the input schema
→Create a stale cached catalog
→Simulate a header/body mismatch
→Test a revoked tool after reconnect

Checks

✓Untrusted metadata does not define permission policy
✓A revoked capability does not return through stale cache

4. Run a revocation drill

Outcome: The team can isolate and revoke a compromised capability without a full blackout.

Tasks

→Find every affected agent
→Revoke credentials and scopes
→Purge caches
→Check in-flight work
→Return to a known-good version

Checks

✓Time to revoke is measured
✓The regression suite passes after restore

Acceptance criteria

The Capability BOM is complete
New capabilities are deny-by-default
Protocol authentication is separated from business authority
Tool metadata and schema drift are covered by tests
The revocation drill proves known-good recovery