Secure · tool

Agent security checklist

Work through these checks before an agent touches real data or credentials. Each one links to the defence it puts in place, and you can export your progress as a Markdown file for a review or pull request.

0 of 22 done

Ticks are saved in this browser only.

Untrusted input

Label untrusted content wherever it enters the agentMark web pages, emails, issues, tickets and tool results that outsiders can write. Anything on that list can carry instructions.Break the lethal trifecta →Split agents so none holds all three trifecta legsIf an agent reads untrusted content, take away either its private data or its outbound channel. Where one agent needs all three, use plan-then-execute or a dual-LLM design.Constrain the agent after untrusted input →Review and pin the descriptions of every connected toolTool descriptions go straight into the model's context. Read them before connecting a server, and hash them so a later change gets flagged.Vet skills, plugins and MCP servers →Escape model output before rendering or executing itBlock auto-loading of external images and links in rendered output and set a strict CSP. Never pass raw output to a shell, SQL query or eval.Treat model output as untrusted →

Tools and credentials

Start every tool connection read-onlyGrant write, delete or send rights only to the specific tools that need them, and only for the task at hand.Use least-privilege credentials →Scope each token to one project and minimal permissionsNo admin or service_role keys for agents. Short-lived, project-scoped tokens keep a leak as small as possible.Use least-privilege credentials →Require human approval for writes, deletes and sendsShow the full tool arguments in the approval prompt and fail closed if nobody responds. In OpenClaw, set tools.exec.ask to always.Require approval for consequential actions →Pin exact versions of skills, plugins and MCP serversReview the diff before every update and check scanner verdicts from VirusTotal or ClawHub audits. In OpenClaw, set security.installPolicy.Vet skills, plugins and MCP servers →Allow outbound traffic only to hosts each tool needsDeny egress for agents and MCP servers by default. Keep multi-tenant hosts, where anyone can publish content, off every auto-approved list.Restrict outbound network access →

Runtime and network

Run code and shell tools in a sandboxUse a container or VM with no credentials and only the workspace mounted. In OpenClaw, turn sandboxing on, set tools.exec.security to deny or allowlist and keep elevated mode off.Sandbox code and tool execution →Bind gateways and dashboards to loopback onlyReach them remotely through an SSH tunnel or Tailscale Serve and use a token of at least 24 characters. Run openclaw security audit --deep to confirm.Keep control planes off the internet →Limit who can message the agentUse DM pairing or an allowlist and require a mention in group chats. Anyone who can message the agent can try to instruct it.Control who can message the agent →Give each user or sender a separate sessionDifferent people should never share one conversation context. In OpenClaw, set session.dmScope to per-channel-peer.Isolate MCP sessions and tenants →

MCP servers and clients

Reject MCP tokens that were not issued for your serverCheck the audience of every access token, and have clients send RFC 8707 resource indicators so each token is bound to one server.Validate MCP token audience →Never pass client tokens through to upstream APIsObtain separate tokens for upstream calls. If your server proxies to third parties, collect consent from each client to avoid a confused deputy.Validate MCP token audience →Keep MCP SDKs and tools on patched versionsAt minimum: TypeScript SDK 1.26.0, Python SDK 1.27.2, mcp-remote 0.1.16 and MCP Inspector 0.14.1. Create one server and transport per session.Isolate MCP sessions and tenants →

CI and code review

Give no secrets to CI agents that outsiders can triggerAgent jobs that run on pull requests, issues or comments from outsiders get a read-only token and no repository secrets.Keep secrets out of untrusted CI runs →Treat pull request and issue text as hostileTitles, descriptions, comments and diffs from outsiders can carry instructions. Require maintainer approval before any job with secrets runs on them.Keep secrets out of untrusted CI runs →

Operations

Log every tool call with its arguments and resultKeep the log where the agent cannot edit it. You need it to reconstruct an incident and to spot unusual calls.Keep a fast way to stop agents and revoke their tokensKnow how to halt every running agent and revoke its credentials within minutes. Rehearse it before you need it.Test your agents against prompt injection before releasePlant instructions in the content your agent reads, such as issues, emails and web pages, and confirm no consequential action follows. Repeat after each change to tools or prompts.Verify agent signatures before trusting agent trafficCheck Web Bot Auth signatures against the operator's key directory to identify an agent. Authorise what it may do separately, because a signature identifies the operator, not the user.Verify agent signatures, then authorise →

Export as Markdown

SECURITY-CHECKLIST.md

## Untrusted input
- [ ] Label untrusted content wherever it enters the agent
- [ ] Split agents so none holds all three trifecta legs
- [ ] Review and pin the descriptions of every connected tool
- [ ] Escape model output before rendering or executing it

## Tools and credentials
- [ ] Start every tool connection read-only
- [ ] Scope each token to one project and minimal permissions
- [ ] Require human approval for writes, deletes and sends
- [ ] Pin exact versions of skills, plugins and MCP servers
- [ ] Allow outbound traffic only to hosts each tool needs

## Runtime and network
- [ ] Run code and shell tools in a sandbox
- [ ] Bind gateways and dashboards to loopback only
- [ ] Limit who can message the agent
- [ ] Give each user or sender a separate session

## MCP servers and clients
- [ ] Reject MCP tokens that were not issued for your server
- [ ] Never pass client tokens through to upstream APIs
- [ ] Keep MCP SDKs and tools on patched versions

## CI and code review
- [ ] Give no secrets to CI agents that outsiders can trigger
- [ ] Treat pull request and issue text as hostile

## Operations
- [ ] Log every tool call with its arguments and result
- [ ] Keep a fast way to stop agents and revoke their tokens
- [ ] Test your agents against prompt injection before release
- [ ] Verify agent signatures before trusting agent traffic