The instruction supply chain is the path by which plain language, tool descriptions, prompts, and returned text influence what an AI agent does. It is different from the code supply chain because the risky material may be natural language rather than executable software, yet still change agent behaviour.
Expanded Definition
The MCP instruction supply chain is the sequence of human-written and machine-generated instructions that shape an agent’s behaviour when it uses Model Context Protocol connections, tools, and retrieved context. It includes tool descriptions, system prompts, connector metadata, example outputs, and any returned text that later becomes part of the agent’s decision process. Because MCP standardises how an agent discovers and talks to tools, a compromised instruction path can influence execution without touching application code. That makes it a security concern for both AI governance and identity-adjacent control, especially when tool access is tied to Non-Human Identity (NHI) credentials or delegated authority.
Definitions vary across vendors on how much of the instruction path belongs to MCP itself versus the surrounding agent stack, so the boundary should be stated explicitly in policy and architecture documents. NHI Management Group treats this term as the trust chain for agent-facing instructions, not just prompt text in isolation. For adjacent guidance on agent risk, the OWASP Agentic AI Top 10 is useful because it frames how instruction manipulation can become an execution risk. The most common misapplication is treating MCP content as harmless documentation, which occurs when teams fail to review tool metadata and returned text with the same scrutiny applied to code.
Examples and Use Cases
Implementing instruction supply chain controls rigorously often introduces review overhead and slower tool onboarding, requiring organisations to weigh agent agility against the cost of verification.
- A connector registry stores tool descriptions that the agent reads before choosing which API to call. If that registry is modified, the agent may prefer an unsafe or overprivileged path.
- An MCP server returns natural-language guidance alongside data. If that guidance is untrusted, the agent may follow attacker-shaped instructions instead of the intended workflow.
- A prompt template includes business rules, escalation logic, and secret-handling instructions. A small wording change can redirect the agent into disclosing data or overusing credentials.
- An integration attaches environment-specific examples to help the agent decide. If those examples are poisoned, the agent may learn the wrong approval path or tool sequence.
- A review process treats returned text as content only, while the agent later reuses it in planning. That turns a benign response into a persistent instruction source.
For teams building policy around this class of risk, the OWASP Non-Human Identity Top 10 helps connect instruction integrity with the credentials and service identities that agents use to act. The point is not just whether a tool call is authorised, but whether the instructions that led to that call were trustworthy.
Why It Matters for Security Teams
The security impact is that instruction poisoning can convert a normally trusted agent into an action-taking liability. If the surrounding chain is not validated, an attacker does not need to break the model itself; they can alter what the agent reads, what it trusts, or how it interprets returned text. That makes this term especially important for teams using agents with NHI-backed access, because the instruction layer becomes part of the control plane for privileged actions. It also matters for governance: without provenance, review, and segregation of trusted versus untrusted instruction sources, there is no reliable way to explain why an agent chose a tool or produced a harmful response.
Security teams should therefore classify instruction sources, log transformations, and constrain which MCP components can supply policy-relevant guidance. The OWASP Top 10 for Agentic Applications 2026 is relevant here because it reflects the operational reality that agent failures often begin with input trust failures rather than code defects. Organisations typically encounter the full impact only after an agent has taken the wrong action or exposed sensitive data, at which point instruction supply chain controls become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Covers agentic input and tool-trust risks that this term describes. | |
| OWASP Non-Human Identity Top 10 | Connects agent instructions to NHI credentials and delegated tool authority. | |
| NIST AI RMF | Governance and mapping of AI risks includes instruction integrity concerns. | |
| NIST CSF 2.0 | PR.DS-1 | Protects data-in-transit and integrity concerns relevant to instruction paths. |
| NIST SP 800-63 | Identity assurance matters when agents use delegated credentials to act. |
Require strong assurance for any human or service identity that can alter agent instructions.
