Proposal: Security audit pattern for AI agent tools (MCP servers)

[edgarfloresguerra2011-a11y]

Security audit for AI agent tools

As AI agents (using OpenAI function calling or MCP) increasingly call third-party tools that execute arbitrary code, the ecosystem needs a trust layer.

We built Sentinel — a 3-layer security audit pipeline that has certified 11,115+ MCP servers with signed SHA-256 certificates.

What Sentinel does

• L1.5: 6 metadata checks (AUTH, prompt injection, CORS, OAuth, rate limiting)
• L1.6: Static analysis (18 Semgrep rules + 18 secret patterns + OSV API)
• L2: Docker sandbox with active MCP probing (adversarial inputs: path traversal, SSRF, SQL injection, command injection)

Results

• 11,115 servers certified
• Risk: 6 low, 10,831 medium, 125 high, 16 critical
• Public verification: https://marketnow.site/verify
• API: GET https://marketnow.site/api/audit-skill?certificate=1&skillId=mn-gen-00003

Proposal for OpenAI Cookbook

Could we contribute a cookbook example showing how to:

1. Verify a tool security certificate before calling it
2. Implement the 3-layer audit pattern for custom tools
3. Use signed certificates for agent tool trust

This would be relevant for any OpenAI agent that uses MCP or external tools.

Source: https://github.com/edgarfloresguerra2011-a11y/marketnow
Transparency: https://marketnow.site/sentinel-transparency

Would the OpenAI community be interested in a security pattern cookbook?

[edgarfloresguerra2011-a11y]

Update: L2.5 gVisor sandbox now live

Since I opened this issue, I shipped L2.5: gVisor sandbox isolation for MCP server audits. gVisor is Google's userspace kernel (used in Cloud Run) — the MCP server never touches the host kernel.

The full audit pipeline now:

• L1.5: Static analysis (dependency scan, license check, secret detection)
• L1.6: Pattern-based behavioral analysis
• L2 v2.0: Active MCP probe (60+ adversarial inputs: path traversal, SSRF, SQL injection, command injection, prompt injection, credential access)
• L2.5: gVisor sandbox (userspace kernel) — NEW
• L3 (Q1 2027): Firecracker microVM
• L4 (Q4 2026): Supply chain attestation (SLSA Level 3)
• L5 (Q3 2027): Third-party audit (Trail of Bits, Cure53)

Test case: I audited Anthropic's official @modelcontextprotocol/server-filesystem with the L2.5 sandbox. It scored 10/10 (low risk) — no network calls, no fs writes, no process spawns, no credential leakage.

Full audit result (public): https://github.com/edgarfloresguerra2011-a11y/marketnow/blob/master/_data/l2_results/mn-mcp-filesystem.json

I wrote up the methodology in two dev.to posts:

• I ran Anthropic's official MCP server in a gVisor sandbox
• How to audit an MCP server: 6 layers

If the OpenAI team is interested in a similar security pattern for the OpenAI Cookbook's agent examples, happy to contribute.