Putting a Deterministic Cop Between Your LLM and Its Tools Is Not Optional Anymore
Two points on HN, and the most important architecture diagram you'll see this month A proxy that sits between an LLM and its MCP servers, enforcing policy the model literally cannot reach or reason its way around. It got two points and zero comments on HN. That gap between significance and attention is the whole story of where AI security is right now. Context: we've been here before, just with…
In the world of AI security, there is a growing realization that a deterministic cop must be placed between language models (LLMs) and their tools. This proxy sits between the LLM and its MCP servers, enforcing policy that the model itself cannot reach or reason around. The significance of this development is evident in the low engagement on Hacker News, highlighting how far behind we are in recognizing the urgency of AI security measures.
This situation is reminiscent of past security battles, with only the nouns changed: instead of MCP servers, think databases; prompt injection becomes tool abuse; and the fix remains the same: don't trust the manipulated input. The untrusted input is no longer a form field but a webpage read by the agent, a tool response ingested, or a document summarized. The model is not a security boundary but an input-shaped surface with variable output.
The hype around the risk of prompt injection is somewhat exaggerated, as it is still underappreciated by many. While it is a serious concern, simply tweaking system prompts or instructing the model not to follow embedded instructions in tool output is not a security control. The real security lies in implementing least privilege, deny-by-default, and policy enforcement outside the trust boundary of the manipulated entity.
What makes this situation novel is the time pressure caused by the widespread adoption of agentic tool-calling before the equivalent of a firewall for it was developed. The narrative that AI security requires a completely new discipline and thinking is mostly propagated by those selling security solutions. In reality, it is simply classic access control applied to a new calling convention.
For developers using MCP or similar architectures, the practical takeaway is straightforward: treat the LLM's tool-invocation intent as you would any untrusted client request. Validate it against policy that the model cannot influence through its inputs or outputs. If your access control relies solely on the model's instructions, you lack true access control and are merely relying on hopeful comments in your prompt.
Security teams should be aware that agent deployments will require architectural reviews similar to those conducted for any new privileged-service integration. However, the threat model is now different, as the client making requests is nondeterministic and may include potentially malicious content. This requires a distinct approach to threat modeling.
The low HN engagement indicates that we are still in the early stages of understanding and addressing AI security. Seatbelt designs are not debated until after accidents occur. The question remains: who will ultimately be responsible for implementing this policy enforcement? Will it be the platform vendor, the app developer, or the security team? And how much friction will people be willing to accept before quietly disabling it?
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
