The Trust Boundary Problem: Securing MCP in Production Agent Systems

Enterprise teams are deploying AI agents backed by MCP servers into production workflows like automating code review, triaging support tickets, querying internal databases, and executing business logic. The threat model most organizations apply? None. MCP is trusted by default, and that assumption is a ticking clock.
This talk is a practitioner's guide to hardening MCP based agent deployments. Drawing from real-world assessment findings across production agentic systems, I mapped out where trust boundaries collapse: between the LLM and its tools, between orchestrator agents and sub-agents, between MCP servers and the host filesystem or network.
I will showcase a defensive architecture built around five controls: (1) MCP server allowlisting with cryptographic attestation, (2) tool-call audit logging with semantic anomaly detection, (3) scoped permission models per agent persona, (4) output sanitization pipelines before downstream action execution, and (5) agent behavior baselining for drift detection

The audience will leave with a clear framework for spotting trust-boundary mistakes in agent architectures and a set of concrete patterns they can apply immediately. It is especially useful for teams building or reviewing production AI workflows and wanting to avoid brittle, hard-to-debug failures.