Technical guide · Standard and security practice
Agent endpoint security: public discovery without excessive authority
A practical boundary between public capability metadata and protected execution: safe URLs, TLS, authentication, scoped authorization, least privilege, secrets, rate limits, and confirmation for irreversible actions.
- Published
- Updated
Scope: this guide explains a technical signal observed by AI Web Check. It does not claim that the signal causes ranking, indexing, citation or inclusion in AI answers.
Public discovery must be safe by itself
Agent-facing documents may publish endpoint URLs and authentication requirements, but not credentials. URLs in UCP profiles, Agent Cards, OpenAPI documents, or MCP declarations should be safe public endpoints rather than localhost, private-network addresses, or URLs with embedded usernames and passwords.
HTTPS protects transport but does not provide authorization. The server still has to decide who may perform which action, against which resource, and with which scope.
What AI Web Check evaluates
The checker validates declared agent endpoints conservatively and rejects credential-bearing, local, private, or otherwise unsafe publication patterns. Raw discovery documents, keys, signatures, and secret values are not stored as public research data.
AI Web Check never executes checkout, payment, order creation, A2A tasks, or MCP tools. Passive discovery auditing and active authorization testing are intentionally separate activities.
Scopes matter more than the presence of a token
Use short-lived, service-specific credentials with least-privilege scopes. A universal administrator token for an agent turns orchestration mistakes into security incidents.
State-changing operations should also enforce resource authorization, input validation, rate limits, idempotency, and audit logging. Payments and other irreversible actions need an additional confirmation or policy gate.
Dangerous publication patterns
- API keys or bearer tokens inside Agent Cards, UCP profiles, OpenAPI server URLs, or public MCP metadata.
- Endpoints on 127.0.0.1, RFC1918/private networks, link-local addresses, or credential-bearing URLs.
- State-changing operations without scopes or server-side resource authorization.
- One credential reused for discovery, catalog reads, and financial operations.
- Automated “security tests” that place real orders or execute destructive operations.