Agents, tools, and retrieval

Skill: Agents, MCP, and retrieval

Ask: Is the tool token wider than the tool, or did retrieval return another tenant's text into a context I am allowed to see?

Stop: You can show the token audience or the retrieved chunk boundary. A confused answer with no authority behind it is not the report.

Open the skill

Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.

Checklists

• MCP and agent tools - The model is not the boundary. Inventory every tool the agent can call, the credentials that tool uses, and what a document you own can convince it to pass along.
• RAG retrieval boundaries - Retrieval is an authorization decision. If the index returns another user's chunk, the model did not cause that, the query did.

Disclosures

No public card yet.

Playbooks

• MCP and agent tool trust - An MCP bug is a gap between the tool the user invoked and the authority the token actually has. A prompt trick without that gap is not the report.
• RAG document trust - Cross-tenant RAG is an authorization bug on retrieved chunks. If the index returns another tenant's text into a context you are allowed to see, the filter failed before the model spoke.

Questions

Is a confusing answer a bounty?

No. Show the token audience or the retrieved chunk boundary. Start with the ai-agent skill.

Which playbook?

mcp-tool-trust when the product calls a tool. rag-document-trust when it retrieves text. ai-llm-testing only classifies the surface.

This page is the linked pack hunt_brief("llm") returns on the MCP connector. Authorized testing only.