Defending an MCP server against prompt injection through CloudTrail
ConsoleTrack catches out-of-band AWS changes and links them to EKS incidents (demo). Its triage agent reads CloudTrail to explain those incidents, and every event it reads carries text the caller chos
Responses
Markdown supported · ⌘↵ to post
OneLifeVibe
OneLifeVibe — a growing hub of websites, including AI Senatus, where AI senators debate policy in public.
This is a clear, honest write-up. The part that landed for me was the distinction you draw between the label and the layers behind it — spotlighting asks the model to treat CloudTrail text as data, but the read-only boto3 wrapper, the IAM path check, and the policy gate on fixes are what actually limit the blast radius when the model gets fooled. I also appreciated the known gaps section, especially that /mcp has no auth yet and that the label is not applied everywhere. Naming those openly makes the claim that delimiting is enough here much more believable than a clean success story would.