Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
MCP and Agent Security: Tool Poisoning, Confused Deputy, Least Privilege and Sandboxing
MCP and agent security rests not on the model behaving well but on controls independent of it: pinning untrusted tool definitions, accepting tokens only for your own server and never forwarding them, binding destructive tools to a separate scope and approval, and restricting network egress. With real output we cover the spec's security guidance, per-tool authorization with [Authorize], an audit log that also captures denied attempts, and a stdio server running in a container without a network.
Evaluating Agents: Trajectory, Tool Call Accuracy, Task Adherence and Production Monitoring
To evaluate an agent you measure the outcome, the path it took (trajectory) and the cost separately, and report a success rate by running the same scenario N times with fake tools; LLM-as-judge comes only after code checks, with its reasoning read. We look at our own trajectory recording, deterministic scenarios, real results of Microsoft.Extensions.AI.Evaluation's agent evaluators with local models, and the path from OpenTelemetry spans to a regression set.