THREAT TAXONOMY
OWASP LLM Top 10
Every detection pattern carries an OWASP LLM Top 10 category ID, so each alert lands in the taxonomy your SOC already speaks.
How CheckedAgent inspects every message.
Two independent pipelines — one inspecting everything your agents send, one inspecting everything their tools send back. Every stage of both, and what each is built to catch.
The multi-tier pipeline, both directions.
Every MCP message — request and response — passes through an independent stack of detectors.
Agent
MCP client
CheckedAgent inspection layer
Request pipeline
T1Policy
→T2Patterns
→T3Obfusc.
→T4Semantic
→T5Behavior
→T6SLM
Response pipeline
R5Behavior
←R4Content
←R3Envelope
←R2Classifier
←R1Wire guards
Tools
MCP servers
— The request pipeline
What the agent sends.
TIER1POLICY
Your policy, before detection runs.
Tenant-scoped business rules — agent permissions, identity scopes, tool boundaries, time windows, rate limits. Pre-built defaults or fully custom; respected by every tier downstream.
Position
Gateway edge, pre-detection.
Every message enters here.
TIER2PATTERN MATCH
Threat signatures.
Pattern matching across the full known-attack corpus — prompt injections, credential theft attempts, URL exfiltration, command injection. Maintained against the relevant threat catalogues.
Catches
Known attack patterns
Across the mapped attack categories.
TIER3OBFUSCATION
Catches what's hiding in plain sight.
Attacks that disguise themselves as ordinary text. Encoded, substituted and invisible-character payloads are resolved to their true form and re-inspected against the full pattern corpus — so obfuscation buys an attacker nothing.
Catches
Disguised threats
Evasion by encoding and substitution.
TIER4SEMANTIC AI
Understanding meaning, not just text.
AI-powered semantic analysis catches polite-but-malicious intent — the attack that reads as a normal request to a regex but is engineered to subvert the agent's reasoning. Coverage maps to OWASP Agentic Top 10 and MITRE ATLAS, so every signal carries a technique ID your SOC already recognises.
Catches
Polite-but-malicious
Novel paraphrases, intent-based attacks.
TIER5BEHAVIOURAL
Agent-level fraud detection.
Tracks what each agent normally does and flags departures from its own baseline — across communication volume, tool usage, timing and parameter patterns. The agent that suddenly tries to read the entire customer table at 3am gets stopped.
Catches
Behavioural drift
Anomalies vs. agent's own baseline.
TIER6CLASSIFIER
The final checkpoint.
A small, fast AI model trained specifically on security threats — not a generalist LLM. It adjudicates the cases that need judgement rather than pattern matching. It runs inline and in-region, with no call to a third-party model.
Verdict
Final adjudication
Judgement, not pattern matching.
— The response pipeline
What the tool sends back.
The request side asks whether a message is a known attack. The response side asks a different question: does what came back match what was asked — and is it safe for the agent, the user, and every downstream system? Five stages, every one correlated to the request that triggered it.
STAGER1WIRE GUARDS
The response, bracketed at the wire.
Before any content is parsed, size caps, decompression-ratio limits, and nesting-depth checks bound what a tool can return. An expansion bomb or a response that violates the rate floor is stopped here, before it can exhaust the agent or hide a payload in sheer volume.
Position
Wire edge, pre-parse
Every response enters here.
STAGER2CLASSIFIER
Sort the message, route each block.
Every response is classified — a normal result, a notification, or a server-initiated request — and each content block is routed by where it is going. A block destined for the model is inspected differently from a URL the agent might fetch or a file a human will open. The routing decides which detectors run.
Routes to
Four sink tracks
Right detectors, right destination.
STAGER3ENVELOPE
The shape has to be right.
Version-aware validation of the JSON-RPC envelope: the response must conform to the protocol version in force for the session, carry no unexpected fields, and arrive within a plausible time window for that tool. Structural anomalies surface before content inspection even begins.
Validates
Protocol envelope
Conforms to the session's protocol version.
STAGER4CONTENT
Inspected by where it's going.
Content is inspected by destination, not just by pattern. Text bound for the model is scanned for instructions disguised as data. Structured data is validated against the tool's declared output contract — including tools that declare a contract and then return free text to sidestep it. Every returned URL is treated as a deferred attack. Anything a human or a downstream system will render is checked for active content. Four tracks, four threat models — a URL and a spreadsheet cell fail in different ways.
Catches
Per-destination threats
Scaled to payload size, up to streaming.
STAGER5BEHAVIOUR
Does the answer fit the question?
The stage that has no request-side equivalent. Every response is correlated to the request that triggered it and checked for coherence — in scope, in proportion, and in tenant. Individually clean content that doesn't fit the request it answers is exactly how a compromised tool hides. This is where it surfaces.
Correlates
Request ↔ response
The compromised-server catch.
What we catch.
Two surfaces, two purpose-built detector sets. Both fire inline before the agent or the tool sees the message — every signal logged for audit.
REQUEST SIDE / synchronous
What the agent is about to send
- Prompt injection — Direct attempts to override the agent's task or extract its system prompt.
- Indirect injection — Instructions hidden inside untrusted documents, emails, search results.
- Credential harvest — Patterns that exfiltrate API keys, tokens, secrets.
- Homoglyph & Unicode obfuscation — Visually-similar characters used to bypass naive filters.
- The Lethal Trifecta — Combinations of sensitive data, untrusted input, and external communication.
RESPONSE SIDE / synchronous
What the tool returned
- Compromised tool responses — Instructions disguised as data.
- Rug-pull tool definitions — Tool descriptions changing behaviour between calls or sessions.
- Response social engineering — Plausible responses that redirect the agent off-task.
- Outbound exfiltration channels — Side-channels disguised as legitimate tool calls.
- Typosquat MCP servers — Server identity pinned and continuously verified; substitution and drift surface immediately.
CROSS-SESSION / asynchronous
What only shows up across time, sessions, or tenants — surfaced post-hoc via the audit chain
- Shadow agents — Unsanctioned agents calling sanctioned tools under stolen or borrowed identity. Detected by behavioural fingerprint drift across sessions.
- Zombie leaks — Slow exfiltration spread across many low-signal calls that pass any single-message check. Detected by aggregate volumetrics across the audit chain.
Mapped to every framework that matters.
Every detection in the pipeline carries a technique ID and a category mapping. OWASP for the threat taxonomy your SOC already speaks. MITRE ATLAS for kill-chain analysis. The compliance frameworks your auditor will ask about.
KILL-CHAIN
MITRE ATLAS
Every alert ships with its MITRE ATLAS technique ID, so it drops straight into the kill-chain analysis your threat hunters already run — from prompt injection through tool-based exfiltration.
RESPONSE-SIDE
Production response gates
The MCP response path runs an independent inspection pipeline. Each gate carries Adversa AI MCP, OWASP, MITRE ATLAS, and CWE category metadata — schema drift, rug pulls, instruction injection in tool results, undeclared capability use, transport substitution.
EU REGULATION
EU AI Act
Article 12 — high-risk system logging. Article 13 — transparency obligations. Regulation (EU) 2024/1689 — high-risk enforcement deferred to December 2027 under the Digital Omnibus.
CONTROL MAPPING
SOC 2 & ISO/IEC 27001 controls
The tamper-evident audit chain produces evidence mapped to the control families your auditor works from — SOC 2 security, availability and confidentiality criteria, and ISO/IEC 27001 Annex A.12 (logging) and A.16 (incident management) — so the evidence is ready when your attestation work begins. The controls map to CheckedAgent; the certification stays yours.
Every verdict, logged.
The Detection Event Log is the single timeline of every agent communication CheckedAgent has inspected. Pass, block, or flag — every record carries the agent identity, the threat signature, the tier that caught it, and a cryptographic signature.
Total events
1,847
76.9 / hr avg
Blocked
23
1.2% of events
Quarantined
41
2.2% of events
Critical alerts
3
last 24h
Event volume by severity
CriticalHighWarningInfo
Top categories (246)
- Prompt Injection87
- Instruction Injection64
- Schema Drift41
- Data Exfiltration28
- Deferred Execution Hold15
- Credential Harvesting11
24 other categoriesSEE
Live event feed
All severities ▾All pipelines ▾All types ▾
TIMEPIPELINECATEGORYTOOLSEVERITYAGENT
- 14:23:07RESPInstruction Injectionpostgres_queryCriticalagent-v6-84
- 14:22:51REQRequest Data Exfiltrationhttp_fetchCriticalagent-v6-84
- 14:22:44RESPSchema Driftslack_api.postMediumagent-v5-12
- 14:22:38REQRequest Prompt Injectionfilesystem.writeHighagent-v6-84
- 14:22:31RESPDeferred Execution Holdshell.execMediumagent-v2-87
- 14:22:24REQServer Identity Driftapi_gatewayMediumagent-v5-12
— Request a demo
Every Agent action.
Checked.
30-minute walkthrough with a security engineer — not a sales rep. We'll show the full pipeline, run your suspected attack patterns through it, and answer the questions your auditor is already asking.