Governance · 5 minute read
AI Supply Chain Security: Models, Prompts, and MCP Servers
AI supply chain security extends software supply chain practice to models and weights, hosted model versions, prompts, datasets, libraries, agent tools, and third-party MCP servers: each has a provenance requirement, a review before use, a registry entry, signing or pinning where possible, sandboxed execution, and monitoring for changes, so a compromised or altered component cannot silently change what agents do.
Software supply chain programs learned to track libraries, sign artifacts, and scan dependencies. AI systems add a new list: model weights downloaded from a hub, hosted model versions that change under you, prompt templates copied from a repository, datasets of uncertain origin, and, most recently, third-party MCP servers that expose tools directly to agents. AI supply chain security applies the same discipline to these components. This guide sets out what to track and how, complementing the AI security checklist and the MCP governance in how enterprise IT should govern MCP.
What is in the AI supply chain?
| Component | Risk | Control |
|---|---|---|
| Model weights (self-hosted) | Tampered or backdoored weights; license issues | Verified source, hash check, evaluation before use, license review |
| Hosted model versions | Silent behavior change; deprecation | Pinned versions, regression gate, deprecation monitoring, fallback |
| Providers and sub-processors | Data handling changes | Contract terms, assurance reports, change notification |
| Prompts and templates | Copied prompts with hidden instructions; drift | Version control, review, testing |
| Datasets | Poisoned training or evaluation data | Provenance, sampling review, access control |
| Libraries and SDKs | Conventional dependency risks | Existing SCA and pinning |
| Agent tools and connectors | Over-broad access; hidden behavior | Review, classification, least privilege |
| Third-party MCP servers | Poisoned results; exfiltration; hidden tools | Code review, pinning, sandboxing, registry, monitoring |
| Retrieval sources | Poisoned content steering agents | Source trust levels, ingestion controls |
Why do MCP servers deserve special attention?
An MCP server exposes tools, resources, and prompts to any client that connects. A malicious server can describe a tool as harmless and implement it otherwise, return results containing injected instructions, or capture everything the agent passes to it. Controls: review the server's code and its tool descriptions before connecting; pin the version; run it in a sandbox with only the network access its purpose needs; route through the gateway so calls are logged and gated; and monitor result content for injection patterns. The gateway design is in how to build an MCP gateway, and the risks in MCP security risks.
How are hosted models managed as dependencies?
Pin versions explicitly; never route to "latest." Evaluate each new version against the golden dataset before switching, per AI regression testing. Monitor deprecation notices and keep a fallback routable, per model deprecation risk management. Treat a provider incident or a material terms change as a supply chain event with an owner and a response.
How are prompts and datasets governed?
Prompts are code: versioned, reviewed, tested, released through the same gate as any change, per how to build a prompt management system. Datasets carry provenance and access control; evaluation datasets are protected from contamination because a poisoned golden set makes the regression gate blind.
What does the registry hold?
| Field | Purpose |
|---|---|
| Component, type, version, pin | Identity |
| Source and provenance evidence | Trust basis |
| Owner and review date | Accountability |
| Permissions and environments | Blast radius |
| Dependent agents | Impact analysis |
| Monitoring status | Change detection |
When a component is compromised or deprecated, the registry answers "which agents are affected" in minutes.
How do sandboxing and least privilege limit damage?
A compromised tool or MCP server inside a sandbox with an egress allowlist and a scoped credential can do far less than one running with the agent's full access. The environment model is in AI agent sandboxing; the permission model in how to design tool permissions for AI agents.
What does the review before use look like?
| Component | Review questions |
|---|---|
| Self-hosted model | Source verified; hash matches; license permits use; evaluation on the golden dataset passes; behavior on adversarial cases acceptable |
| Hosted model version | Terms unchanged; evaluation passes; latency and cost within budget; fallback routable |
| Prompt or template | Reviewed line by line; no hidden instructions; tested against the regression suite |
| Dataset | Provenance documented; sample reviewed; access controlled; contamination with evaluation data checked |
| Tool or connector | Permissions minimal; parameters constrained; classification assigned; owner named |
| MCP server | Code reviewed; tool descriptions match implementation; network needs stated; sandboxed; version pinned; gateway-routed |
The review is recorded in the registry with a date, so re-review can be scheduled.
What does monitoring look like?
Hash and version checks on self-hosted weights at load; gateway comparison of model behavior metrics across versions; scanning of tool and MCP results for injection patterns; alerts on new tools appearing from a connected server; dependency scanning on libraries; and periodic re-review of third-party components on a schedule tied to their risk.
What are the common mistakes?
- Connecting community MCP servers without review.
- Routing to unpinned models.
- Prompts outside version control.
- No registry, so impact analysis is a search through code.
- Tools running with the agent's full privileges.
- Evaluation datasets writable by everyone.
How does FISTA Solutions help?
FISTA Solutions establishes the registry, gateway, sandboxing, and review practice that AI supply chain security requires through its AI enablement practice, builds MCP servers and gateways that meet those controls, and deploys forward deployed engineers to review third-party components with your security team. FISTA has delivered 150+ projects for 50+ companies across 12+ countries.
To inventory your AI supply chain, message FISTA on WhatsApp, or read MCP security risks for the server-level threats.
Share-ready article cover
Download the generated social format.
Clear answers
Questions raised by this field note.
Straightforward guidance for evaluating scope, fit, and the next step.
01What is in the AI supply chain?
Model weights and hosted model versions, the providers and their sub-processors, prompt templates and libraries, training and evaluation datasets, orchestration libraries and SDKs, agent tools and connectors, third-party MCP servers, and the retrieval sources agents read. Each can be altered, poisoned, or compromised, and each needs provenance and review.
02Why are MCP servers a supply chain risk?
An MCP server is code that exposes tools to agents. A malicious or compromised server can return poisoned results that steer the agent, exfiltrate data passed to it, or expose tools with hidden behavior. Treat third-party servers like privileged dependencies: review the code, pin versions, run them sandboxed with least privilege, and monitor.
03How do you manage hosted model changes?
Pin specific model versions in the gateway, evaluate new versions against the golden dataset before switching, monitor provider deprecation notices, and keep a fallback routable. A silent provider change is a supply chain event; the regression gate is the control that catches it.
04What does a registry need to record?
For every model, prompt, dataset, tool, and MCP server: owner, source and provenance, version and pin, review status and date, permissions granted, environments in which it runs, and the agents that depend on it. The registry makes impact analysis possible when a component is compromised or deprecated.
Continue exploring
Related capabilities
Start with the hard problem
Need the outcome owned, not merely analyzed?
Tell us where delivery is constrained. We’ll map the fastest credible path from intent to verified production.