Attacks · By business pattern

Agents & MCP

Tool-call authority for agents without reusable secrets. Clone and copy stop converting into lasting MCP blast radius when each call spends a bound envelope.

~6 min readRelated: APIs pattern

What the attacker wants

Agent attackers exfiltrate tool secrets or replay tool calls to expand blast radius across MCP surfaces. The estate question is whether a cloned agent still carries lasting ambient authority for every tool.

How it works today

Agent stacks often embed API keys in prompts, env, or tool configs. Possession scales with every clone. Ambient agent security recreates the API-key problem inside orchestration layers.

Why it fails against one-shot proofs

Per-call proofs at the tool boundary mean no ambient tool secret to steal, burn-before-validate on replay, and binding on retarget. Same families as APIs — expressed for agent orchestration. Deep-link ambient, replay, and relay for dual plates.

Treat MCP tool chips as actions that must earn envelopes, not as containers for long-lived keys.

Long-lived API key, cookie, and service account authorizing many calls after one possession — Bearer lives outside the request
How to read: long-lived bearers left; possess-once call-many ambient win. Takeaway: authority survives the call.

Ambient agent success is the cloned config that keeps calling tools.

Per-request proof with burn-before-validate and no leftover channel key — Authority dies with the request
How to read: ambient myths fail; per-request proof and burn succeed. Takeaway: no long-lived bearer on the channel.

Per-call envelopes remove the reusable tool bearer from the clone story.

Every API key, bearer token, and service certificate is a secret that works from anywhere until you notice it is gone.ValidatedAmbient credentials authorize by possession alone; ENI6MA replaces that model with one-shot, request-bound proofs.

Authority expires at the end of each request.ShippingThe envelope binds method, endpoint_id, request hash, policy hash, tau, and nonce (one message, one use).Holds under the reference architecture

Where it shows up

Replay
Tool calls spend nonces.
Relay
Bound to the named tool route.
Ambient credentials
No lasting tool bearer.

Watch it fail

Go deeper

Products · Gate MCP

Agentic AI Systems
ENI6MA Circuit is presented as a minimal cryptographic system for high-assurance encryption, lightweight authentication, and verifiable proof flows aimed at practitioners and agentic AI integrators. Three pillars (an encrypted entropy pool, a symmetric two-way hash stream, and an interactive/non-interactive proof layer) let agents attest knowledge without revealing secrets while keeping operational surfaces simple.

Opening