AI Security Atlas › All entries › Multi-Agent & Memory Trust
Tool Manifest Pinning & Review
Tool definitions are hash-pinned at approval, scanned for hidden instructions, and re-approved on change.
Open in the interactive atlas →Impact
Stops tool poisoning and post-approval rug pulls before tools reach the model.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Mutable Tool Manifests (Critical), MCP Tool Description Poisoning (Critical).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Mutable Tool Manifests Vulnerability · Critical severity
- MCP Tool Description Poisoning Threat · Critical severity
Builds on
- Agent Workload Identity & Signed Tasks Guardrail · Fixes medium risks
Remediation
- Compute a canonical hash of name, description, and schema.
- Diff and surface changes to the user before reconnecting.
- Block descriptions that address the model directly.
How to verify
- Changed manifests never load without fresh consent.
- Scanner flags fixtures containing hidden directives.
Pattern
if (sha256(canonical(tool)) !== pinned[tool.id]) return requireReapproval(tool);Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM03:2025 Supply Chain
OWASP Top 10 for Agentic Applications 2026
- ASI04:2026 Agentic Supply Chain Vulnerabilities
MITRE ATLAS
NIST AI RMF 1.0
- GOVERN 6.1 Policies address AI risks from third-party entities
- MANAGE 3.1 Third-party AI risks are monitored and controls applied