AI Security Atlas › All entries › Autonomous Agent & MCP Security
Deterministic Tool Schema Validation
Hard schema gates reject malformed or semantically illegal tool arguments before any side effect.
Open in the interactive atlas →Impact
Removes entire classes of argument-injection failures at the boundary.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Unvalidated Function Arguments (High), Agent Tool Hijacking (High).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Unvalidated Function Arguments Vulnerability · High severity
- Agent Tool Hijacking Threat · High severity
Remediation
- Generate schemas from typed tool definitions; never hand-edit twice.
- Log and metric schema rejection rates as a detection signal.
- Version schemas and reject clients on major mismatch.
How to verify
- Property-test schemas against adversarial JSON corpora.
- Ensure zero side effects on validation failure paths.
Pattern
const parsed = z.object({ id: z.uuid(), op: z.enum(OPS) }).parse(input);Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM05:2025 Improper Output Handling
- LLM06:2025 Excessive Agency
OWASP Top 10 for Agentic Applications 2026
- ASI02:2026 Tool Misuse and Exploitation
MITRE ATLAS
- AML.M0033 Input and Output Validation for AI Agent Components
NIST AI RMF 1.0
- MEASURE 2.7 AI system security and resilience are evaluated and documented