Agent Builder & Security Stack

Scaffold a secure, spec-compliant MCP server from a description of the tools you want to expose. Sets up the official SDK (TypeScript or Python/FastMCP), defines tools/resources/prompts with strict JSON Schema, wires the right transport (stdio or Streamable HTTP), adds OAuth 2.1 for remote, and hardens against the MCP-specific footguns — prompt injection via tool output, token passthrough, over-broad scopes, command/path/SSRF injection, leaked secrets — before it ships. Returns a runnable skeleton plus a security checklist. Built by someone who's shipped production MCP servers.

Model quality is table stakes — the harness is where agents win or fail. This designs yours: it writes a structured, testable system prompt (role, tools, boundaries, method, output contract, failure handling) and maps every concern to the right layer — prompt, tool, guardrail, or evaluation — so the pieces reinforce each other instead of fighting.

Design the right team of specialized AI subagents for your project and get the definition files written properly — precise delegation triggers, focused system prompts, least-privilege tools, and the right model tier for each job. Includes a template, orchestration patterns, and a complete sample team.

A deep reference library of production agent patterns — orchestration, context, tool design, failure and recovery, oversight, and evaluation. Every pattern states when it applies, when it's the wrong answer, what it costs, and the failure it prevents. Seven reference files, not a checklist.

Red-team your own AI agent for prompt-injection and tool-misuse vulnerabilities before it ships — then fix them. Maps your attack surface, generates a defensive test plan with the safe behavior expected for each case, and gives a prioritized mitigations list. Defensive use only.

A defensive catalog of ~39 agent security attack patterns across every surface — injection, tool abuse, exfiltration, memory poisoning, multi-agent trust, retrieval poisoning — each with a detection signal, a concrete defense, and a severity. Nine reference files plus a threat-model worksheet. For hardening agents you own.

An adversarial gate that audits an MCP server or agent tool definition — schemas, descriptions, scopes, auth — for tool poisoning, excessive agency, injectable descriptions, and missing access controls, then returns one SAFE/REVIEW/BLOCK verdict.

An adversarial security gate that audits untrusted content — web pages, tool outputs, documents, emails — for embedded instructions, exfiltration, and authority spoofing, then returns a SAFE/REVIEW/BLOCK verdict.