API Security for AI Agents: Securing MCP, Function Calling & Tool Use

AI Agents as API Consumers

APIs were designed for human-driven applications — a user clicks a button, the app sends a request. AI agents fundamentally change this model. An autonomous agent can discover, call, and chain API endpoints without human intervention, at machine speed, with unpredictable behavior.

The Shift: Traditional API security assumes a human in the loop. AI agents remove that assumption. They can call thousands of endpoints per minute, probe for vulnerabilities, exploit business logic, and exfiltrate data — all while following their programmed instructions "correctly."

How AI Agents Interact with APIs

---

Securing Function Calling

The Function Calling Security Model

When you register functions with an AI model (OpenAI, Anthropic, etc.), the model decides which functions to call based on user input. This creates a critical security boundary:

User Input → [AI Model] → Function Selection → [Your Code] → Side Effects
              ^                                       ^
              |                                       |
         Prompt injection                    Insufficient validation
         can redirect function               can cause damage
         selection

Secure Function Registration

// VULNERABLE — Overly broad function with no constraints
const tools = [{
  name: "database_query",
  description: "Execute any SQL query on the database",
  parameters: {
    query: { type: "string", description: "SQL query to execute" }
  }
}];

// SECURE — Constrained, specific functions with validation
const tools = [{
  name: "get_user_orders",
  description: "Get orders for the currently authenticated user",
  parameters: {
    status: {
      type: "string",
      enum: ["pending", "shipped", "delivered", "cancelled"],
      description: "Filter by order status"
    },
    limit: {
      type: "number",
      minimum: 1,
      maximum: 50,
      description: "Maximum orders to return"
    }
  }
}];

// Function implementation with security checks
async function getUserOrders(params: any, context: AgentContext) {
  // 1. Validate parameters against schema
  const validated = OrderQuerySchema.parse(params);

  // 2. Enforce user scope — agent can only see current user's data
  const orders = await Order.find({
    userId: context.authenticatedUserId, // Never from params!
    status: validated.status,
  }).limit(validated.limit);

  // 3. Filter sensitive fields from response
  return orders.map(o => ({
    id: o.id,
    status: o.status,
    total: o.total,
    createdAt: o.createdAt,
    // Exclude: internalNotes, costPrice, supplierInfo
  }));
}

Function Calling Security Rules

1. Design functions with least privilege — Each function should do one thing with minimal permissions
2. Never pass user identity via parameters — Extract from the authenticated session/token
3. Validate all parameters server-side — The AI model can be manipulated to send unexpected values
4. Use enums and strict types — Avoid freeform string parameters where possible
5. Implement function-level rate limiting — Separate from API-level rate limiting
6. Log every function invocation — Full audit trail including parameters and results
7. Require human confirmation for destructive actions — DELETE, financial transactions, data modifications

---

Securing MCP Servers

MCP Server Threat Model

MCP Server Hardening Checklist

□ Run MCP servers in isolated containers (no host filesystem access)
□ Network: allowlist only required outbound connections
□ No shell execution capability unless absolutely required
□ Read-only filesystem access where possible
□ Environment variables: only pass required credentials
□ Validate all tool inputs against strict JSON schemas
□ Sanitize all tool outputs (strip potential injection patterns)
□ Log every tool invocation with full context
□ Implement per-tool rate limiting
□ Set resource limits (CPU, memory, execution time)
□ Code review all third-party MCP servers before installation
□ Pin MCP server versions (no auto-updates in production)

---

Rate Limiting for AI Agents

Traditional rate limiting (requests per minute per IP) doesn't work well for AI agents. You need agent-aware rate limiting:

// Agent-aware rate limiting middleware
const agentRateLimiter = {
  // Per-agent limits (identified by API key or OAuth client)
  perAgent: {
    requestsPerMinute: 60,
    tokensPerMinute: 100000,     // LLM token budget
    toolCallsPerMinute: 30,      // Function/tool invocations
    writeOperationsPerMinute: 10, // Mutations
    costPerDay: 50.00,           // Dollar budget limit
  },

  // Per-user-per-agent limits (agent acting on behalf of a user)  
  perUserPerAgent: {
    requestsPerMinute: 20,
    dataRecordsPerMinute: 100,   // Records accessed
    writeOperationsPerHour: 25,
  },

  // Global safety limits
  global: {
    maxConcurrentAgentSessions: 100,
    maxAgentChainDepth: 3,       // Agent spawning sub-agents
    emergencyShutdownOnAnomalyScore: 0.95,
  },
};

---

Monitoring AI Agent API Usage

Track these signals to detect compromised or misbehaving AI agents:

---

Further Reading

• OWASP Top 10 for Agentic AI — Complete agentic AI risk framework
• Securing Generative AI APIs — MCP and Shadow AI security
• AI Agent IAM — Identity management for agents
• API Security Trends 2026 — Broader API threat landscape