Agentic AIVSS Risk Scoring

Rechecked source anchors against the public MCP specification 2026-07-28 on August 21, 2026.

What this adds

The Agentic AIVSS Risk Scoring Pack is the prioritization layer for the Secure Context Layer. It maps emerging agentic risks into:

• A reproducible 0-10 AIVSS-aligned risk score.
• Severity bands: critical, high, medium, and low.
• Runtime default decisions: monitor, guarded receipt, human review, deny pending remediation, or kill-session.
• Remediation SLA and owner guidance.
• Evidence keys linking each risk to generated SecurityRecipes packs.
• Hosted MCP readiness gates that describe the production product surface.

The pack is intentionally conservative: it is AIVSS-aligned, not an official OWASP calculator. The scoring vector is source-controlled so teams can inspect and fork the assumptions.

Workflow at a glance

Agentic AIVSS Risk Scoring workflow

Produce a reproducible AIVSS-aligned severity, remediation SLA, owner, and runtime default for one agentic risk scenario.

agent-assurance

1. 01

   Signal

   Select the risk scenario

   Capture the agentic weakness, affected system, exposure, autonomy, data, permissions, controls, and observed evidence.

2. 02

   Scope

   Score base characteristics

   Rate exploitability, impact, scope, human oversight, persistence, propagation, and reversibility using versioned factors.

3. 03

   Decision

   Apply environmental context

   Adjust for deployment criticality, reachable authority, compensating controls, evidence confidence, and active exploitation.

4. 04

   Action

   Set severity and action

   Assign score, band, owner, SLA, and runtime default such as monitor, review, deny, or kill.

5. 05

   Proof

   Record the scoring vector

   Publish factor values, rationale, sources, control links, uncertainties, and next reassessment event.

Decision gate

Does the scored scenario remain below the runtime and remediation threshold for its environment?

Proceed

Apply the documented SLA and guarded runtime default.

Hold or stop

Deny or kill critical unsafe events and escalate high-severity scenarios for immediate remediation.

Evidence to retain

• versioned scoring vector
• scenario/control evidence
• severity, SLA, and runtime decision

Expected outputs

• AIVSS-aligned score record
• prioritized remediation item
• runtime policy update

Generated artifacts

Run the generator after posture, exposure, MCP, skill, approval, action, or incident evidence changes:

Evaluate a runtime event:

python3 scripts/evaluate_agentic_aivss_risk_decision.py \
  --scenario-id mcp_tool_misuse_lethal_session \
  --expect-decision hold_for_human_security_review

Kill an unsafe high-autonomy event:

Risk scenarios

The profile scores nine high-value enterprise scenarios:

• Agent goal hijack through poisoned context.
• MCP tool misuse in a lethal session combination.
• Identity and privilege abuse by an agent.
• Agentic supply chain or skill compromise.
• Unexpected code execution through tool or skill paths.
• Insecure inter-agent handoff or remote agent trust.
• Cascading failure or runaway agent operation.
• Human-agent trust exploitation or approval bypass.
• Rogue agent or shadow MCP server.

Each score includes recommended controls, evidence keys, owner, SLA, and a hosted MCP readiness gate that makes the open evidence operationally useful.

Current industry alignment

This pack tracks the strongest current source signals:

• OWASP AIVSS v0.8 for AI-specific risk scoring.
• OWASP Top 10 for Agentic Applications for goal hijack, tool misuse, identity abuse, supply chain, unexpected execution, context poisoning, inter-agent failure, cascading failure, trust exploitation, and rogue agents.
• OWASP MCP Top 10 for protocol-layer token, scope, tool, command, authorization, telemetry, shadow-server, and context-sharing risks.
• OWASP Agentic Skills Top 10 for the behavior and execution layer that sits between model intent and real tool authority.
• NIST AI 600-1 for govern, map, measure, and manage expectations.
• MCP Authorization for resource indicators, audience binding, token handling, and scope minimization.

MCP surface

The MCP server exposes:

• recipes_agentic_aivss_risk_scoring_pack

Use the pack tool for reviewer, platform, and remediation-priority review. Use the evaluator before a gateway or agent host allows high-autonomy execution, external writes, untrusted context, shadow MCP servers, unregistered agents, or unpinned skills.

What to look at first

For enterprise or trust review diligence, start with:

1. severity_summary - critical/high counts and runtime decision mix.
2. risk_scores - the scored risk scenarios and owners.
3. remediation_queue - the prioritized critical/high worklist.
4. source_artifacts - hashes for the evidence used in scoring.
5. hosted_mcp_wedges - the productizable path from open evidence to production MCP enforcement.