Guides

AI agent and MCP security, in practice

What an agent can do is defined by configuration that changes with every pull request. These guides explain where that authority comes from and how to review it before it ships.

• MCP server security: know what each server lets your agent doHow a new or updated MCP server quietly expands what an AI agent can do, the real incidents behind the risk, and how to review MCP changes before they ship.
• Claude Code hooks and permissions: what a pull request can grant an agentClaude Code hooks, permission rules, and settings live in your repository. What they can grant, why review misses them, and how to gate them in CI.
• AI agent permissions: least privilege for software that chooses its own actionsWhy least privilege is harder for AI agents than for services, how agent permissions drift through tools and delegation, and how to keep them reviewable.
• What is an Agent Capability Bill of Materials (ACBOM)?An Agent Capability Bill of Materials lists what each AI agent can do: its tools, servers, identities, and delegations. What it contains and how teams use it.

Want the concrete version? See what ControlLoop catches, with an example pull request for each.