Part IV · The protocol layer

This is where the trust boundaries between components live, and where most of the real incidents have happened. A protocol connecting an agent to tools is a protocol that carries attacker-influenced text into a privileged execution path.

Each part of this book splits the same three ways: how it works, how it breaks, and how you hold it. The attack and the control for one layer sit together, because that is how you actually meet them.

How it works

IV.1 Model APIs & the tool-use loop Model APIs as stateless endpoints, the tool-use loop that turns a chatbot into an agent, and the classic API hygiene that still applies. concept · 1 min read IV.2 Model Context Protocol (MCP) How MCP works - primitives, transports, lifecycle - plus its OWASP MCP Top 10 threats, sampling/elicitation abuse, threat modeling, OAuth 2.1 authorization, and hardening. concept · 24 min read

How it breaks

IV.3 The MCP assessment runbook The end-to-end procedure for assessing an MCP deployment - inventory, enumerate, read what the model reads, test authorization, chain, report - with the commands to run at each step. attack · 6 min read IV.4 Multi-agent systems, A2A & the seams Google's A2A protocol for cross-agent delegation, Agent Card discovery, the MAESTRO threat model, and the core A2A attack/defense cards. attack · 3 min read

How you hold it

IV.5 Hardening MCP - gateways, allowlists, runtime defense The defensive half of MCP: what the 2026-07-28 spec makes normative, the gateway pattern, deterministic authorization at the server, and what to log so an incident is reconstructable. defense · 8 min read IV.6 Agent identity & access (NHI) The non-human-identity problem: treating each agent as a managed, least-privilege identity across the provision-to-deprovision lifecycle. defense · 6 min read