What happens if an AI agent is given a tool that is too powerful or poorly designed?

In Part 2 of our series, Tomasz Janaszka, Solutions Architect at CodiLime, demonstrates why Model Context Protocol (MCP) scopes alone aren't enough to protect your infrastructure.

This video dives into the "Raw Command" antipattern and shows how to build a second line of defense directly on your network devices. We explore the transition from agent-level permissions to device-level enforcement, covering:

  • Why creating a tool that accepts arbitrary strings is a major security hole. Tomasz demonstrates how a simple prompt injection can trick an agent into shutting down BGP processes, even if its MCP scope is set to "Read-only."
  • How to move away from static credentials. Learn how to use OpenBao to generate short-lived (60-second) SSH certificates based on the user's identity.
  • Using an OpenSSH validator script to intercept every command. If the agent tries to inject forbidden characters (like ;, |, or &), the device rejects the request before it executes.
  • How to delegate command-level checks to a central server to ensure that even "badly designed tools" cannot perform unauthorized actions.