---
name: ai-llm-mcp-trust-review
description: Trace authorized untrusted content through prompts, retrieval, memory, tools, MCP resources, and output sinks to measurable effects.
---

# AI, LLM, and MCP trust review

## Accepted inputs

- Current scope and controlled users, content, data, and tools
- System boundaries, model or agent configuration, tool schemas, and output destinations
- Explicitly allowed effects and prohibited data classes

## Procedure

1. Map trust boundaries for instructions, retrieved content, memory, tool arguments, tool results, identities, and renderers.
2. Record each tool's permissions, confirmation behavior, side effects, and data reach.
3. Establish a benign controlled task and a no-tool or denied-tool negative control.
4. Introduce one controlled untrusted instruction at a time.
5. Measure whether it changes a privileged argument, action, disclosure, durable memory, or unsafe output sink.
6. Separate model text, intended tool behavior, user-approved action, and unauthorized effect.

## Output artifacts

- Trust and privilege map
- Injection path with source, transformation, and sink
- Paired traces and measurable effect boundary

## Stop conditions

No uncontrolled recipients, real secrets, destructive tools, persistence beyond owned data, or action outside explicit authorization.

## Completion gate

Complete only when controlled untrusted content causes a reproducible unauthorized effect past a defined trust boundary, or the path is rejected with meaningful controls. Prompt influence alone is not impact.