# AI agent egress control: constrain the request and the role

> Review AI agent egress, MCP request paths, local metadata access and execution-role scope. Read the field guide and download the six-page PDF.

[Canonical HTML page](https://trustcyber.ca/insights/agent-egress-control/)

- Author: [Junior Williams](https://trustcyber.ca/about/)
- Type: Field guide
- Published: 2026-10-13
- Modified: 2026-10-13
- Topics: AI agents, Cybersecurity, AI governance

An agent that reads public websites needs a defined network boundary and an execution role scoped to its work. This field guide explains how to review both, including MCP request paths and local metadata access.

## Review reachability and authority together

A destination policy controls where a component can connect. Its execution identity controls what it can do when it arrives. Review both for public retrieval, authentication discovery and privileged business operations. Separate an untrusted retrieval component from privileged execution where the platform permits it, and assess the local credential boundary explicitly.

## What the evidence establishes

The PDF separates Zenity’s AgentCorruption findings from AWS guidance and the author’s architecture recommendations. It preserves the distinction between researcher findings, provider documentation and evidence about an actual deployment. The report is not evidence of a current customer breach, a microVM escape or universal cross-account compromise.

AWS documents AgentCore’s MicroVM Metadata Service (MMDS) as a source of execution-role credentials inside the VM, independently of network mode. Code or actors inside that VM can access those credentials. EC2’s Instance Metadata Service (IMDS) has related concepts, but its configuration guidance needs to be interpreted for the actual runtime.

## Map every request origin

A fetch server opens connections from its own host. An MCP client can also fetch OAuth metadata during authentication, before a tool call occurs. Include browser tools, HTTP-source connectors, authentication discovery and shell environments in the request inventory. Name the initiating process, destination classes, resolver, proxy, credentials and control owner.

**Separate controls for each request path**

| Request path | Control to establish | Evidence to retain |
| --- | --- | --- |
| Public retrieval | Approved destination policy and narrow execution identity | Effective DNS, redirect and connection enforcement |
| Authentication discovery | Policy for every discovery URL | Approved identity services and client-side enforcement |
| Business operations | Narrow operation and scoped identity | Destination authorization and required permissions |
| Local metadata | Runtime-specific access boundary | Which processes can reach credentials and why |

## Enforce the policy at the connection

Public retrieval should begin without access to private, loopback, link-local or other reserved destinations. Document required exceptions. Internal business connectors need a narrow allowlist for their intended service and authorization at that service. Apply the destination policy across IPv4, IPv6 and redirects, bind address validation to the connection, and preserve TLS hostname verification.

A proxy covers only the traffic it mediates. Review alternate libraries, direct sockets, shell access and configuration permissions. A local metadata request may never traverse an external proxy. Prompt instructions alone cannot enforce these transport boundaries.

## Review fixes and permissions separately

The six-page PDF compares records for MCP fetch, Google MCP Toolbox and the rmcp Rust SDK. It distinguishes advisory publication dates from package releases and describes the limits of the fixes. Use maintained releases containing the relevant fixes, pin reviewed dependencies and confirm the running artifact. A patch in one library does not establish coverage for every request path.

Use the runtime’s own metadata and execution-role guidance. Explain required actions and resource permissions in terms of specific operations. Prefer narrow business tools, preserve authorization at the destination and keep credentials out of model-visible results. Short-lived credentials retain their granted permissions while valid.

## Evidence an architecture review should produce

Retain a request map, allowed destinations and denied classes, an isolated policy test record, a bypass review, effective role permissions, telemetry coverage and running artifact versions. Use inert fixtures for redirects, changing DNS answers, IPv6 and proxy-side resolution. Redact credentials, authorization headers and sensitive query values from records.

Check the monitoring surface before promising coverage. Establish what tool, process and enforcing-proxy records actually capture, including local metadata access. Assign an owner and review date to approved exceptions, and retest when the runtime or request path changes.

## Read the full field guide

The PDF includes an illustrative architecture diagram, the three security-record comparisons, six proposed review outputs and nineteen references. It connects network reachability to runtime authorization and sensitive tool output. TrustCyber architecture advisory can help review agent tool egress, metadata exposure and execution-role scope.

## Selected primary sources

- [AWS — AgentCore credentials management](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html)
- [AWS — AgentCore Runtime security best practices](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-security-best-practices.html)
- [OWASP — SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)
- [MCP — Security Best Practices (version cited in the PDF)](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices)
- [Zenity — AgentCorruption research](https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model)
- [MCP servers — fetch fix PR #5033](https://github.com/modelcontextprotocol/servers/pull/5033)
- [PyPI — mcp-server-fetch 2026.10.10](https://pypi.org/project/mcp-server-fetch/2026.10.10/)
- [Google MCP Toolbox — v1.5.0 release](https://github.com/googleapis/mcp-toolbox/releases/tag/v1.5.0)
- [GitHub — rmcp OAuth metadata advisory](https://github.com/advisories/GHSA-c9xm-49cp-xcr9)
- [AWS — VPC Flow Log limitations](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-limitations.html)

## Caveat

Living documentation and package status can change. Assess the actual runtime, request path and effective permissions; an individual patch or metadata setting does not establish complete coverage.

## Evidence note

This web edition summarizes the supplied field guide dated 13 October 2026. Researcher claims remain attributed; the proposed review outputs are architecture recommendations, not claims about an existing deployment. The PDF contains the complete references and chronology.

## Resources

- [Downloadable PDF](https://trustcyber.ca/guides/agent-egress-control.pdf)

## Related insights

- [OSFI’s AI warning: waiting is a decision, too](https://trustcyber.ca/insights/osfi-ai-investment-decisions/index.md)
- [Cyber Readiness in the Frontier AI Era](https://trustcyber.ca/insights/frontier-ai-cyber-readiness/index.md)
- [Check Permission at the Moment of Action](https://trustcyber.ca/insights/ai-agent-runtime-authorization/index.md)