MCP security for a small business is a supply chain. Microsoft June 2026: poisoned tool descriptions can steer an agent while every click looks routine. Pin, read the description, no standing shell.
MCP security for a small business is a supply-chain problem, not a Chrome-extension problem. Model Context Protocol is how an agent learns which tools exist and when to call them. The tool description is natural language the model trusts. Microsoft Incident Response documented in June 2026 how a poisoned description can steer an agent while every click still looks routine. Pin what you install. Read the description. Do not give the agent a standing shell.
I am Amelia S. Gagne, CEO of Kief Studio. I run agents in a two-person studio. Brian owns the deep exploit work. This page is shop-floor rules. Identity of the agent is non-human identity. Path control is sequence governance.
MCP servers advertise tools. The agent reads the name, the summary, and the long description. You see a friendly card. The model sees instructions. Invariant Labs named tool poisoning in April 2025. Microsoft's 30 June 2026 post walked a finance workflow: the visible summary stayed the same, the description gained a buried order to attach unpaid invoices to the next call. The agent did not "break a rule." It followed metadata.
Microsoft Security (30 Jun 2026) maps that pattern to OWASP agentic classes for tool misuse and supply chain. You do not need the full catalog. You need an allowlist and a human who reads diffs.
A skill is a reusable bundle of instructions an agent can load. OWASP Agentic Skills Top 10 v1.0 (17 Aug 2026) leads with malicious skills and supply-chain compromise. AST07 is update drift. AST05 is untrusted external instructions: a skill that fetches a URL at runtime is loading someone else's prompt with your permissions.
Monday rules for a studio using Claude, Cursor, or similar:
It is not a reason to ban agents. It is not a CVE dump. It is not "install a gateway and forget it." Isolation helps. An allowlist helps. A person who treats description diffs like code review is the control that scales to two people. kief.dev is where we publish engineering hygiene. briansgagne.com is the architecture when you need depth. LTFI is a hired department, not an MCP you paste into Cursor.
We do not run a security committee. We run a diff. New MCP or skill: paste the description into the PR, say what tools it may call, say what it must never call. Update: same PR. If the description grew a paragraph about "also fetch," that is the Microsoft invoice example in miniature. Reject it. Lockfile hygiene is the same muscle. Skills and MCP are dependencies that speak English.
Do not load a skill that pulls live instructions from a random URL. OWASP AST05 is that pattern. Inline the instructions you trust. Pin the rest. If you cannot explain why a tool is on the machine, it is not on the machine.
If you connected an agent to mail, files, or invoices, you have a supply chain. Size of company does not change the description field.
Yes, once per install and on every update. Microsoft treats description changes as dependency updates. That is the whole control.
They travel a similar path: instructions the agent trusts, often with extra tools. OWASP's skills list is the skill-shaped version of the same chain. Inventory both.
No standing production credentials on an agent that can load third-party MCP or skills. Pin, read, gate irreversible tools.
Five Eyes agentic AI guidance for a small business is five moves: low-risk task, distinct identity, least privilege, human gate, logs plus a kill switch. CISA, NSA, and allies published Careful Adoption of Agentic AI Services on 1 May 2026.
A non-human identity for an AI agent is a unique login for the agent itself, not a copy of yours. NIST 2026: own identifier, credentials, entitlements. If it uses your password, that is impersonation.
Non-compliance costs $14.82 million on average versus $5.47 million to maintain compliance, a 2.71x gap. Compliance engineering means building systems where evidence generates itself, not assembling it from memory before each audit.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
