Agents, Skills, and MCP Servers Are a Software Supply Chain: Build an Admission-Control Pipeline

Reusable agent components accelerate delivery. They also import instructions, code, dependencies, credentials, tool reach, and egress into the runtime. Security therefore needs a version-bound admission decision—not a trust badge attached to a name.

s, container images, and service templates. A skill can encode a high-value operating procedure. An MCP server can turn an internal API into a discoverable tool surface. A prebuilt agent can compress weeks of orchestration work into a deployable starting point. This is useful precisely because the component brings behavior with it.

That same property creates the security problem. An agent component is not only source code. It may contain natural-language instructions that alter model behavior, scripts with install-time effects, third-party libraries, credential flows, tool schemas, allowed destinations, and assumptions about who may authorize an action. A conventional malware scan is still necessary, but it does not answer whether a seemingly benign instruction causes secret disclosure, whether a read-only tool can be chained into a write path, or whether installation reaches an undeclared endpoint.

The right abstraction is an admission-control pipeline for behavior-bearing releases. The decision should bind to an immutable state, scale review depth with capability, exercise uncertain behavior under containment, and expire when material facts change.

Review a release, not a listing

‍