Developer Tools
Security Analysis Agent and MCP Tooling
Built agentic security-analysis workflows backed by an MCP server, retrieval, and specialized tools for investigating network and system telemetry.
- Python
- FastAPI
- MCP
- PyTorch
- PostgreSQL
- Docker
- Kubernetes
- OpenShift
- TCP/IP
- SSL/TLS
Problem
Investigating network and system telemetry for security questions typically requires stitching together many disconnected tools and manual queries, which slows down analysis and makes it hard to reproduce.
Constraints
- Tool outputs must be grounded in real telemetry, not model speculation
- Multi-step investigations need to be reliable and testable, not one-shot prompts
- Deployment has to fit existing container/orchestration infrastructure
Approach
Built a tool-oriented agent architecture on top of the Model Context Protocol (MCP), where the agent composes calls to specialized, narrowly-scoped tools (retrieval, telemetry queries, protocol-aware helpers) rather than relying on a single general-purpose prompt.
System design
Agent request and tool-execution flow
A request is planned into one or more tool calls, each tool queries a scoped data source, and results are grounded and summarized before being returned.
- Analyst request
- Agent planning step
- MCP tool selection (network / system / retrieval tools)
- Tool execution against telemetry sources
- Grounded result aggregation
- Summarized response with cited tool outputs
Tradeoffs and limitations
Narrow, single-purpose tools are easier to test and reason about than one large general tool, but require more upfront design work to cover the range of analyst questions.
Results
Delivered a working set of specialized analytical tools covering common security and network investigation questions, deployed within existing container/orchestration infrastructure. Specific counts are being confirmed before publishing — see the TODO in the project data file.
What I learned
Reliability in agent systems comes mostly from constraining what each tool can do and testing those boundaries directly, rather than from prompting the agent to behave carefully.
Next steps
Expand automated test coverage for multi-step workflows and formalize the security boundaries between tools with different data-access scopes.