SmeltSec Glossary: MCP, AI Security, and Developer Terms
Short definitions for the MCP protocol, AI security, and developer terms referenced across SmeltSec. Each entry is one to three sentences.
A
Agent (AI agent)
An LLM or system that uses tools to take actions on behalf of a user. Agents combine a language model with a set of tool definitions and a loop that interprets model output to call those tools.
Attestation
A record of how a generated artifact was produced. SmeltSec emits assessment and provenance statements that can be signed explicitly; independent verification requires a valid signature bound to the expected build identity.
B
Behavioral analysis
LLM-based dynamic analysis of what a tool actually does at runtime. Behavioral analysis correlates tool descriptions, parameters, and observed side effects to flag deceptive or unsafe behavior that static checks miss.
Breadcrumbs
A navigation pattern that shows the user's location in a site hierarchy. Breadcrumbs are also a schema.org type (BreadcrumbList) that search engines use to render richer results.
C
Canonical URL
An HTML or HTTP signal that declares which URL is the primary version of a page. Canonical URLs prevent duplicate-content issues when the same page is reachable through multiple paths or query strings.
CI/CD gate
An automated check in a pipeline that can block a deploy when conditions fail. Security gates run before merge or release and return a non-zero exit code when a policy violation is detected.
CVE
Common Vulnerabilities and Exposures: a public identifier for a specific security flaw in software. CVEs carry a unique ID such as CVE-2024-12345 and map to scoring systems like CVSS.
D
DLP (Data Loss Prevention)
Scanning runtime traffic for sensitive data patterns such as credit-card numbers, API keys, or PII. DLP rules block or redact matches before data leaves a trusted boundary.
DOMPurify
A common HTML sanitizer that strips dangerous markup and scripts from untrusted input. It is referenced here as a general secure-development pattern for preventing cross-site scripting.
E
Evasion detection
Techniques for finding deliberately obfuscated malicious code. Evasion detection looks for encoded strings, control-flow flattening, packed payloads, and other signals that a file is trying to hide its intent.
Extension
A container for a capability in some clients such as VS Code or Chrome. Extensions package code that runs inside a host application and often request permissions to access local resources.
F
FAQPage
A schema.org type for structured FAQ data. When a page emits FAQPage JSON-LD, search engines can render the questions and answers directly in results.
FastMCP
A Python framework for building MCP servers quickly. FastMCP handles protocol plumbing so authors can focus on tool definitions and business logic.
G
Gate 1
SmeltSec's pre-generation stage. Hosted generation invokes Semgrep and Gitleaks; full CLI/orchestrated scans can add dependency and built-in evidence when their inputs and binaries are available.
Gate 2
SmeltSec's configurable post-generation checks over generated artifacts, tool definitions, permissions, and fixed correlation rules. They are available across plans when inputs support them; authenticated transcript evaluation is a separate workflow.
Gitleaks
An open-source secret scanner released under the MIT license. SmeltSec artifact scans invoke Gitleaks in no-git mode; repository-history coverage requires a separate history-aware invocation.
H
Hallucination
An LLM generating false information confidently. Hallucinations are a core risk for agents because a fabricated fact or tool argument can trigger real-world side effects.
HMAC
Hash-based Message Authentication Code: a signed-message pattern used for integrity and authenticity. Webhooks commonly attach an HMAC signature so recipients can verify the payload came from the expected sender.
I
Indirect prompt injection
An attack where malicious content arrives via tool output rather than user input. The LLM reads attacker-controlled text from a fetched page, email, or document and follows its instructions.
Inngest
A durable-workflow service that SmeltSec uses for background jobs. Inngest handles retries, fan-out, and state so long-running scans can survive restarts and failures.
J
JSON-LD
JavaScript Object Notation for Linked Data: a structured-data format that Google and AI crawlers consume. JSON-LD blocks are embedded in HTML to describe entities, breadcrumbs, FAQs, and more.
L
llms.txt
An emerging standard file for declaring AI-crawler guidance at the root of a site. It lists canonical content URLs and context that large language models should use when answering questions about the site.
LLM (Large Language Model)
The underlying model powering an AI agent. LLMs are trained on broad text corpora and respond to prompts by predicting likely continuations.
M
MCP (Model Context Protocol)
Anthropic's open protocol for AI tool integration. MCP standardizes how agents discover and call tools, read resources, and receive prompts from external servers.
MCP-Scan
A third-party open-source scanner for MCP-specific threats. It is a separate product; SmeltSec does not bundle or invoke the MCP-Scan CLI and instead uses its own built-in MCP checks.
MCP server
A process that exposes tools and resources to AI agents via the MCP protocol. An MCP server can run locally over stdio or remotely over HTTP and SSE.
N
Namespace collision
When two MCP servers register tools with the same name. Agents may call the wrong tool or refuse to call either, so clients and servers should prefix tool names to stay unambiguous.
O
OpenAPI
A specification format for describing REST APIs. SmeltSec uses OpenAPI documents as input for MCP server generation, mapping endpoints to tool definitions.
OSV-Scanner
Google's vulnerability scanner for open-source dependencies. SmeltSec does not invoke this binary; its dependency scanner queries the OSV advisory API for supported npm and Python metadata.
P
Permission escalation
When a chain of tool calls achieves capabilities the attacker was not directly granted. An MCP server might hold read-only file access and network fetch, but combining them can exfiltrate data across a trust boundary.
Prompt injection
An attack that manipulates an LLM via crafted input. Direct prompt injection overrides the system prompt; indirect prompt injection smuggles instructions through data the model reads.
Provenance
A verifiable history of how an artifact was built. Provenance records include source commits, build steps, inputs, and signatures that let downstream consumers confirm what they are running.
Q
Quality score
SmeltSec's normalized evaluation of MCP tool definitions across twelve weighted dimensions: descriptions, schemas, spec conformance, annotation fidelity, overlap, security, naming, output contract, parameter complexity, error semantics, error handling, and presentation.
R
Rate limit
A cap on how many calls a user or tool can make in a time window. Rate limits protect downstream services from bursts and are a first line of defense against abuse.
ReDoS
Regex denial-of-service: a catastrophic-backtracking attack on a regex engine. An attacker submits a crafted input that forces exponential matching time and stalls the process.
S
SAST
Static Application Security Testing: code analysis performed without executing the program. SAST tools parse source and identify patterns associated with vulnerabilities such as injection flaws or unsafe deserialization.
SBOM
Software Bill of Materials: an inventory of every dependency in a build. SBOMs are the basis for vulnerability scanning, license auditing, and supply-chain compliance.
Semgrep
A SAST tool SmeltSec uses to enforce security and quality rules on source code. The Community Edition is released under the LGPL license and supports custom rule packs.
Speakable
A schema.org hint that marks sections of a page suitable for voice-search playback. Search assistants use Speakable annotations to decide which text to read aloud.
Supply-chain attack
Compromising software by compromising its build or dependencies. An attacker poisons an upstream package or CI step so downstream consumers receive malicious code with their next update.
T
Tool definition
The metadata an MCP server exposes to an LLM: a name, description, and parameter schema. The LLM reads tool definitions to decide when and how to call each tool.
Tool poisoning
Modifying a tool's description or schema to manipulate LLM behavior. A poisoned description can inject hidden instructions that the agent treats as authoritative.
Tree-sitter
An incremental parser library SmeltSec uses to analyze source code. Tree-sitter produces concrete syntax trees that enable precise pattern matching across many languages.
Trojan source
A Unicode bidirectional-override attack that hides code from reviewers. Trojan-source payloads render differently in editors than they do to a compiler, letting malicious logic slip past manual review.
Typosquatting
Registering a package name similar to a popular one to trick installs. A developer who types lodahs instead of lodash may pull a malicious package with the same general API shape.
U
Unsafe deserialization
Parsing untrusted serialized data with a format that allows code execution. Formats like pickle in Python and Java's ObjectInputStream can execute attacker-controlled code during load.
V
Vulnerability disclosure
The process of reporting a security flaw to a vendor so it can be fixed. Coordinated disclosure gives the maintainer a window to ship a patch before public details are released.
W
Webhook
An HTTP callback sent when an event occurs. SmeltSec's catalog currently includes generation.completed, generation.failed, changes.detected, score.completed, and update.available; deliveries are HMAC-SHA256 signed.
Workspace
A SmeltSec tenant-level container for users, servers, and policies. Each workspace has its own billing, roles, and data scope.
Z
Zero trust
A security model that assumes no implicit trust based on network location. Every request is authenticated, authorized, and logged regardless of whether it originates inside or outside a corporate network.
Ship MCP servers with security built in.
Start free. Upgrade when you need advanced analysis and monitoring.