Treat Every MCP Server as Untrusted: Building agent-airlock for Production Agents

In April 2026, OX Security disclosed CVE-2026-30623, a class of remote-code-execution-by-design in STDIO MCP servers. Three weeks earlier, the first production version of my company's agent platform had gone live. The CVE arrived before the design conversation that should have preceded it.

Agentic systems in 2026 default to trust. The MCP SDK assumes the server is friendly. The orchestrator assumes the tool is safe. The host assumes the agent will not jailbreak its own argument schema. Each of those assumptions has cost somebody a CVE in the last twelve months: CVE-2026-30623 (MCP STDIO RCE), CVE-2026-25592 (Semantic Kernel Filter-Eval RCE), CVE-2026-33032 (MCPwn, CVSS 9.8), CVE-2025-59536 (Claude Code hook RCE), CVE-2026-21852 (enableAllProjectMcpServers source-code leak), CVE-2026-41349 (Anthropic's 2026-04-23 postmortem).

This talk introduces agent-airlock, an Apache-2.0 Python package I wrote around my own agents. One @Airlock() decorator wraps any MCP tool call with: ghost-argument stripping, type validation, PII masking, RBAC, E2B / Firecracker microVM sandboxing, network airgap, circuit breaker, cost tracking, and a per-call signed-capability-lease envelope (JSON Schema draft 2020-12). It is a drop-in for LangChain, OpenAI Agents SDK, PydanticAI, CrewAI, AutoGen, and AWS Bedrock Managed Agents (Codex / GPT-5.5 limited preview, April 28). v0.8.1 ships 2,405 tests, 82.77% coverage, 13 framework integrations.

What I will walk through:

- Why the host side, not the protocol, is the right place to enforce per-call capability leases.

- The concrete attacks agent-airlock blocks today, with code paths and red-team transcripts from production.

- What is hard: argument-tree validation under generative schemas, circuit-breaker tuning for non-deterministic tools, attestation across self-hosted versus first-party MCP boundaries.

- What I got wrong in the v0.1 to v0.8 progression, and what mnemo-baseline (per-agent drift detector with OTel + OCSF emitters) added when I stopped trusting my own audit logs.

Anchored on running multiple specialized agents in production at Attri.ai across insurance, healthcare, legal, geospatial, and ITSM verticals. No product pitch. Code, rule list, and failure modes are all open.

- The host-side decorator pattern beats protocol-level patches for per-call capability enforcement, and why that ordering matters when the protocol itself is the attack surface.

- Concrete code paths for ghost-argument stripping, schema validation, RBAC, and microVM sandboxing are composed in one wrapper rather than five middleware layers.

- A working signed-capability-lease envelope (JSON Schema draft 2020-12) and how it slots into LangChain, OpenAI Agents SDK, and Bedrock Managed Agents without changing the agent code.

- Honest limits: where attestation breaks across MCP boundaries, where E2B is not enough, and how mnemo-baseline catches the case where your own audit log is wrong.

- An open scanner → firewall → drift-baseline stack that maps to OWASP Agentic Top 10, OWASP MCP Top 10, NIST AI RMF Profile-for-Agents (in progress), India DPDP Act, and EU AI Act — usable today, not a vendor roadmap.