TrifectaLint

A CLI that reads an agent's tool and MCP config, tags each tool by what it can touch, and fails the build when a single agent holds private-data access, untrusted-content intake, and an outbound channel at once.

Problem

A team wires an inbox reader, a CRM connector and a web-fetch tool into one assistant, each reviewed and approved on its own. Nobody checks the combination, and the combination is the exploit: a crafted email or web page can tell the agent to read private records and send them out. Today's scanners inspect single servers or single prompts, not what one agent can do once its tools are loaded together.

Target user

A platform or security engineer at a 20 to 200 person company that ships internal agents built on MCP servers or an agent SDK. They need a pass/fail check in pull requests that answers one question: which agents hold all three legs, and which tool would break the triangle if removed.

MVP scope

• Parse MCP config files (Claude Desktop, Cursor, VS Code style) and one agent SDK tool-list format into a per-agent tool inventory.
• Classify each tool into three legs (reads private data, ingests attacker-controllable content, can send data or act outside the boundary) using a hand-editable rules file, with a shipped default for the 30 most common public MCP servers.
• Report every agent where all three legs are present, name the minimal set of tools whose removal leaves two legs, and exit non-zero.
• Support an allowlist for the outbound leg (named destinations) so an agent with a pinned egress list is downgraded from fail to warn.
• Emit SARIF so findings show up in GitHub code scanning.
• Test against a fixture repo of five agents with known leg counts; the expected output is checked in.

Monetization

Freemium. The CLI and default rules are open source. A paid hosted tier at about $29 per month per org adds a rules registry updated as new servers ship, a diff view of leg changes per PR, and a Slack digest of agents that crossed into three legs. Demand for the paid tier is unproven.

Why now

The three-leg framing comes from Simon Willison's June 2025 post, and Meta's "Agents Rule of Two" turned it into a design rule. A Cloud Security Alliance research note dated 2026-06-30 describes the LayerX "BioShocking" technique against six AI browsers and extensions and names the same combination (authenticated data, untrusted content, a network path) as the cause. The 2026 OWASP LLM Top 10 moved Excessive Agency to third place, per the CSA note on OWASP's list. These are agent-level properties, and existing tools score servers one at a time.

Risks & open questions

• Demand: teams that already know the trifecta may just check by hand for the handful of agents they run, so the pain may not justify a paid tool.
• Classification is the hard part. Whether a tool "ingests untrusted content" depends on deployment (a Slack connector in a private channel versus a public one), and a static rules file will be wrong often.
• Build: MCP config formats differ across clients and change often; solo maintenance of parsers and the default rules registry is real ongoing work.
• Config only shows what an agent can do, not what it does at runtime, so it will miss tools added dynamically by an MCP server after connection.
• A warning-heavy tool gets ignored; the pass/fail threshold needs tuning on real repos before anyone trusts it.

Next step

Run a prototype over 10 public repos that ship MCP configs and count how many agents fail; if more than a quarter do, promote to weekly prototype.

Sources

• https://simonwillison.net/2025/jun/16/the-lethal-trifecta/ — defines the three legs (private data, untrusted content, external communication), published 2025-06-16.
• https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-browser-prompt-injection-20260630-csa-s/ — CSA note dated 2026-06-30 on the LayerX BioShocking technique against AI browsers and the combination that enables it.
• https://labs.cloudsecurityalliance.org/research/csa-research-note-owasp-genai-top10-2026-agent-control-stand/ — CSA note on the 2026 OWASP LLM Top 10, including Excessive Agency moving to third.
• https://archestra.ai/blog/lethal-trifecta-definition — secondary explainer on the trifecta and mitigations such as egress allowlists.