Building Harvey's MCP Policy Engine (www.harvey.ai)

Harvey has announced the development of its Model Context Protocol (MCP) Policy Engine, designed to enhance the security of its AI agents as they interact with various tools, including research platforms and document management systems. This initiative is critical for the AI/ML community, as it addresses the rising concerns of security vulnerabilities such as prompt injection and tool poisoning, which could potentially expose sensitive information or alter agent behavior. By implementing stringent security measures, Harvey aims to ensure its AI agents can operate safely within an expanding ecosystem of external tools while minimizing the risk of malicious exploitation. The MCP Policy Engine employs a defense-in-depth approach, incorporating principles such as least privilege and complete mediation to control the access and actions of agents within integrated tools. It includes a rigorous review process for securing partner integrations and a "Tool Pinner" feature that tracks changes in tool definitions to prevent unauthorized updates. Additionally, the engine assesses the context of tool calls to evaluate potential risks based on the sequence of actions taken by the agent. Through these comprehensive security measures, Harvey not only fortifies the integrity of its AI systems but also sets a precedent for security practices in the broader AI landscape, reinforcing the importance of proactive security architectures in agentic computing.