Glossary

Agent Scan
Snyk Agent Scan

Snyk Agent Scan is a security scanner for agent ecosystems that detects local components – including MCP servers and skills – and identifies risks such as prompt injection, tool poisoning, toxic workflows, hard-coded secrets and insecure handling of credentials. It closes an emerging gap in the transparency of the agent supply chain

Agent2Agent
A2A

Agent2Agent is an open protocol that enables communication and interoperability between agent-based applications.

Context Graphs

model institutional reasoning – such as policies, exceptions and precedents – as structured, queryable data. Context management techniques use stateful compression and sub-agents to summarise intermediate steps in long-running workflows.

See also

Context Graphs

Development Containers

Development Containers provide a standardised method for defining reproducible, containerised development environments using the devcontainer.json configuration file.

Originally developed to provide teams with consistent development environments, dev containers have found a compelling new use case as isolated execution environments for coding agents. Running an agent in a dev container isolates it from the host’s file system, credentials and network, allowing teams to grant the agent extensive permissions without compromising the host machine.

The open specification is natively supported by VS Code and VS Code-based tools such as Cursor.

DevPod

extends Dev Container support via SSH to any editor or terminal workflow. Dev Containers follow an ephemeral-by-default approach, meaning that the container is recreated from the configuration each time it is started, which provides a clean security boundary, albeit at the cost of having to reinstall tools and dependencies.

Dynamic retrieval

goes beyond basic RAG by selecting tools and loading only the necessary MCP servers, thereby avoiding unnecessary context expansion.

FastMCP

A Python framework that simplifies the setup, protocol handling and error management of an MCP server by abstracting the complexity of the protocol and enabling development teams to define MCP resources and tools via intuitive Python decorators. This abstraction allows teams to focus on business logic, resulting in clearer and more maintainable MCP implementations.

Whilst FastMCP 1.0 is already integrated into the official MCP Python SDK, the MCP standard continues to evolve rapidly. You should therefore keep an eye on the release of version 2.0 and ensure that you keep pace with changes to the official specification.

See also

Model Context Protocol
MCP

open standard that defines how LLM applications and agents integrate with external data sources and tools, with the aim of significantly improving the quality of AI-generated results. MCP focuses on context and access to tools, thereby differing from the Agent2Agent (A2A) protocol, which governs communication between agents. It specifies servers (for data and tools such as databases, wikis and services) as well as clients (agents, applications and coding assistants). Frameworks such as FastMCP have emerged, as has the MCP Registry for identifying public and proprietary tools. However, the protocol also has architectural flaws and has attracted criticism for disregarding established RPC best practices. For production applications, development teams should carry out thorough security checks by mitigating Toxic Flows with tools such as Agent Scan and closely monitoring the authorisation module at runtime.

See also

Prompt caching

pre-provides static instructions, which reduces costs and shortens the time to the first token.

See also

Prompt caching

Sprites

Sprites is a stateful sandbox environment from Fly.io, developed using Firecracker microVMs for the isolated execution of coding agents.

Whilst most sandboxes are short-lived – they are launched for a single task and then disappear again – Sprites provides persistent Linux environments with unlimited checkpointing and rollback capabilities. This enables development teams to take a snapshot of the entire environment state – including installed dependencies, runtime configuration and changes to the file system – and perform a rollback if an agent goes off the rails. This goes beyond what Git alone can restore, as it captures the system state that version control does not track.

Toxic Flows

With the emergence of agents that require extensive permissions, such as OpenClaw, development teams are increasingly deploying agents in environments where they are exposed to a lethal trifecta:

  1. Access to private data

  2. Exposure to untrusted content, and

  3. The ability to communicate externally.

As capabilities grow, so does the attack surface, exposing systems to risks such as prompt injection and tool poisoning.

Toxic flow analysis remains one of the most important techniques for investigating agent-based systems to identify insecure data paths and potential attack vectors. These risks are no longer limited to MCP integrations; we have also observed similar patterns in skills, where a malicious actor can package a seemingly useful function in such a way that it contains a hidden instruction to extract sensitive data. We strongly recommend that development teams working with agents conduct a toxic flow analysis and use tools such as Agent Scan to identify insecure data paths before they are exploited.