The LLM-agnostic defense: Blocking agentic threats at the MCP layer

Autonomous agents are arriving faster than the controls built for chatbots. The protocol underneath that shift is the Model Context Protocol (MCP). FastMCP is the framework many developers use to implement it. A Python function becomes a tool. That tool can query a database, call an internal API, or manage a GitHub repository, and an AI coding agent invokes it with a standard request.

FastMCP removes the friction of building those tools. Permission to use them is a separate decision. The new exposure is a shadow agent: a local assistant, connected by one developer, able to act with that developer's access. It needs only a tool call.

Secure the hands, not the brain

Most AI security still focuses on the model. Filter the prompt. Block a public chatbot. Keep certain data out of the context window. Those controls cover what the model is asked. The tool call needs its own control.

The model is the brain. It reads the request and chooses an action. The tool call is the hands. An agent can edit code, change a record, open a ticket, or delete a repository. A prompt injection can succeed by convincing the model to make a call the tool is already able to perform.

Chasing the brain does not scale. One company may use OpenAI, Anthropic, Gemini, and an open-source model in the same week, often inside different coding agents. A control tied to one provider has to be rebuilt for the next one. The tool request stays the same shape: a server, a tool, and a set of arguments, whichever model selected it.

That is the boundary worth securing. FastMCP standardizes how a tool is built and exposed. MCP standardizes the call. The defense belongs on the call.

How SailPoint-Entro governs the call

SailPoint-Entro governs the agent as a non-human identity. In this architecture, the enforcement point lives inside the MCP server. The server is built with FastMCP, and the SailPoint-Entro Agentic Plugin runs as middleware in that server. The coding agent can be Claude Code, Cursor, VS Code, or Pi harness, with any supported LLM behind it. The middleware sees the same kind of tool call no matter which model sent it.

The developer's prompt becomes an MCP tool call. Inside the FastMCP server, the Agentic Plugin runs as middleware and checks the call against the SailPoint-Entro control plane. If a deny policy matches, the call is blocked before the tool executes. If not, the GitHub tool runs and returns its result.

Instead of trying to parse the model's intent on the fly, the plugin middleware intercepts the call right inside the FastMCP server, referencing the SailPoint-Entro control plane before any execution happens. This control plane manages four core layers:

• Deny policies. These target specific combinations of the agent, the server, the action (read, write, or delete), and the human user. When a call matches, the middleware blocks it.
• Intent classification. Our AI engine labels incoming prompts as benign, suspicious, malicious, or destructive to flag anomalies for investigation.
• Sessions and audit log. Every session captures the raw prompt, the targeted tool, the arguments, the credentials, and the final decision.
• Owner attribution. Every action is permanently tied to the agent as a non-human identity and to the developer who initiated it.

Because the checks live directly inside the server, every tool that the server exposes goes through the same middleware. Swap the model behind Cursor or Claude Code, and the same policy still evaluates the same call. The system also tracks which agents, servers, and non-human identities are already running in your environment without approval.

A deletion that never reaches GitHub

Consider a common scenario: a developer connects a coding agent to an MCP server, built with FastMCP, that exposes a GitHub tool. The agent reads an external pull request. Hidden inside that pull request is an indirect prompt injection instructing the model to delete the repository.

The model complies and requests delete_repository. The call reaches the FastMCP server. While some GitHub tools require a manual confirmation step, that fallback still relies on the client environment and a human catching the warning. The Agentic Plugin middleware runs first, before the GitHub tool executes.

The middleware detects the coding agent, the developer, the targeted GitHub server, and the delete action. Because a deny policy for that action matches, the call is blocked. The agent receives an error, the session is logged with full context, and the repository remains untouched.

Keep the control when the model changes

New models will keep showing up. The security architecture can stay put. The stable pieces are the identity, the MCP server, the action, and the policy.

FastMCP will keep making tools easy to ship. SailPoint-Entro gives the agent an owner, gives the session a record, and stops the action before it runs.