Checklist · Draft

The Builder's Checklist: Securing AI Agents and Home Labs

Draft by alkizz

Most AI security advice is either a 90-page framework or a warning about the robots coming for us. This is neither. It's a list of things you can check this week.

Each item has a why (one line) and a how (the quick version). The robot uprising is not on the list. Your exposed API key is.

This one is for builders: home labs and small teams running agents. Running a company? See The Business Checklist.

You've got Ollama or LM Studio humming, an agent harness with shell access, a Discord bot wired to it, and four MCP servers you installed because a README said so. Good. Let's make sure it's your agent.

Secrets & Keys

1. Get API keys out of your prompts, repos, and dotfiles.

• Why: Anything the agent can read, a prompt injection can ask it to repeat, and anything in git is forever.
• How: Use a secrets manager or at minimum env vars injected at runtime. Run gitleaks or trufflehog on your repos. If a key ever touched a commit, rotate it. Don't just delete the line.

2. One key per tool, with a spend cap.

• Why: One shared "god key" means one leak burns everything, and a runaway loop can burn your credit card (OWASP calls this Unbounded Consumption, LLM10:2025).
• How: Separate keys per agent/integration, set hard budget limits and usage alerts in every provider console, and use fine-grained/read-only tokens wherever the provider supports them.

3. Treat your chat-bot token like a root password.

• Why: A leaked Discord/Slack/Telegram bot token lets anyone be your bot, including whatever tools it's connected to.
• How: Store it like any other secret, limit the bot to the servers/channels it needs, and know where the "reset token" button is before you need it.

Tool Permissions & Sandboxing

4. Run the agent as a nobody, in a box.

• Why: An agent with shell access runs with your privileges. That includes your SSH keys and browser profile.
• How: Run it in a container or VM as a non-root user, mount only the directories it needs, and never mount ~/.ssh, ~/.aws, or your home directory "just to make it work."

5. Default-deny tools; require a human for anything destructive or outbound.

• Why: OWASP lists Excessive Agency (LLM06:2025) for a reason. The agent doesn't need rm, git push, and "send email" to summarize a PDF.
• How: Allowlist tools per task, keep confirm-before-execute on for writes, deletes, payments, and messages. Resist the "auto-approve everything" toggle, at least until you've read the logs for a week.

6. Break the "lethal trifecta."

• Why: Private data + untrusted content + a way to send data out = exfiltration waiting to happen (Simon Willison).
• How: For each agent, list which of the three it has. If it has all three, remove one: no outbound network, no access to secrets/private data, or no untrusted input.

Network Exposure

7. Make sure your local model server is actually local.

• Why: Ollama binds to 127.0.0.1:11434 by default, but one config change exposes it. Cisco found 1,100+ exposed Ollama servers via Shodan, and SentinelLABS/Censys mapped ~175,000 hosts.
• How: Check OLLAMA_HOST and LM Studio's server settings. Run ss -tlnp (or netstat) and look for 0.0.0.0. Need remote access? Put it behind Tailscale/WireGuard or a reverse proxy with auth, never a raw port forward.

8. Keep the model runtime patched.

• Why: Model servers are software with CVEs like anything else, and a year-long study of exposed Ollama endpoints found very few vulnerable hosts ever upgraded in place.
• How: Subscribe to release notes for Ollama/LM Studio/your harness, update on a schedule, and don't run an old version just because it "still works."

9. Restrict the agent's egress.

• Why: Most exfiltration needs an outbound connection. No egress means fewer bad days.
• How: Firewall the agent's container to just the APIs it needs. A simple egress proxy with an allowlist beats a long list of rules you'll never maintain. The MCP security best practices recommend the same, plus blocking private ranges and 169.254.169.254.

Prompt Injection

10. Assume every web page, email, issue, and file the agent reads is hostile.

• Why: Prompt injection is LLM01:2025, and it works through content, not just the chat box. Invariant Labs showed a malicious GitHub issue could steer an agent into leaking private repo data into a public PR.
• How: Don't give an agent that browses or reads inboxes the same tokens that touch private data. Scope tokens to one repo/one mailbox, and review what it's about to do before it does it.

11. Don't trust the output either.

• Why: Model output that gets executed, rendered as HTML, or passed into SQL is Improper Output Handling (LLM05:2025).
• How: Treat model output like user input. Escape it, validate it, and never pipe it straight into eval, a shell, or a database query.

Plugins / MCP Supply Chain

12. Vet MCP servers like you'd vet a stranger's shell script, because that's what they are.

• Why: The postmark-mcp npm package shipped 15 clean versions, then added one line in 1.0.16 that BCC'd every email to the attacker (Postmark's notice).
• How: Install from the vendor's official repo, check the publisher, pin exact versions (no npx some-server@latest in your config), and read the diff before upgrading anything that touches email, files, or credentials.

13. Scan tool descriptions, and watch for "rug pulls."

• Why: Tool poisoning hides instructions in tool descriptions the model reads but you don't, like an "add" tool that also quietly reads ~/.ssh/id_rsa. Descriptions can also change after you approve them.
• How: Read the full tool descriptions, run a scanner like mcp-scan, pin/hash tool definitions, and don't mix untrusted servers in the same session as ones holding sensitive access.

Logging & Kill Switch

14. Log every tool call, with arguments.

• Why: When something weird happens, "the AI did it" is not an incident report.
• How: Log tool name, arguments, timestamp, and result to somewhere the agent can't write to or delete. Skim it weekly; you'll be surprised.

15. Have a kill switch you've actually tested.

• Why: At 2 a.m. you want one command, not a scavenger hunt.
• How: Write down how to stop the agent, revoke its keys, and disconnect the bot. Script it (docker stop, key revocation, token reset) and test it once.

🧰 If You Only Do Five

1. Rotate and scope your keys. Per-tool keys, spend caps, nothing in git. (Items 1-2)
2. Close the ports. Model servers on localhost or behind a VPN, never raw on the internet. (Item 7)
3. Sandbox and default-deny. Agents in containers, minimal tools, a human approves destructive or outbound actions. (Items 4-5)
4. Pin and vet your MCP servers/plugins. Official sources, exact versions, read the diff. (Item 12)
5. Have a kill switch you've actually tested. One command to stop the agent, revoke its keys, and disconnect the bot. (Item 15)

The Closer

None of this is exotic. It's least privilege, patching, egress control, supply chain hygiene, and "call them back before you wire the money," applied to a new kind of software that happens to take instructions from anything it reads. The models will keep getting better. The basics will keep mattering more.

Start with the five. Then come back for the rest. And if you're also on the hook for a company's AI, keep going with The Business Checklist.