QG106 Unpinned tool source¶
| Type | Security hotspot |
| Severity | review |
| Front end | the catalogue's tools and MCP servers, an agent graph's tools, and a Colang configuration's action modules |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MAP |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): a hotspot asks a person to decide what the agent may run and to map where it comes from; nothing is managed until they decide |
| OWASP | LLM04:2026 Supply Chain, ASI04:2026 Agentic Supply Chain Vulnerabilities |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A tool, an MCP server or an action module the agent calls has no version pin or digest in the catalogue or the source manifest.
Why it matters¶
The code behind the tool can change without the configuration changing: a new release of the package, a server that updates itself, an action module edited in place. It may be meant -- a team can track a server's latest version on purpose. The hunter reports the missing pin; it does not judge the version pinned.
How to fix it¶
Pin the version exactly, or record the digest, and add every action module to the source manifest; or accept the hotspot with the reason.
OWASP LLM04:2026 and ASI04:2026, pin and verify what you run: pin each rail, tool, server and action module to a version or a digest.
OWASP entries¶
LLM04:2026 Supply Chain and ASI04 Agentic Supply Chain Vulnerabilities, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because code the agent runs that can change without its configuration changing is the supply chain's exposure. The coverage is at the policy level: the rule decides the part of the risk the policy and its catalogue control, and a scan with no finding under it says that and no more.
What the finding carries¶
A location at the declaration, and a fingerprint over the rule, what it names and the location. There is no witness: the defect is in the text, as for QG007-QG009. The rule fires only on a declaration the team made in the catalogue, agent.yaml or the configuration; a missing declaration raises nothing, and the scan summary lists the rule as having had nothing to read. See the catalogue for the other rules.