> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.10-hosted-agent-framework-dependencies.md). # 2.10 Hosted-agent framework dependencies How to secure hosted-agent dependencies across SDKs, tools, MCP servers, prompts, models, containers, deployment pipelines, and runtime services. *Last reviewed: August 18, 2026* {% hint style="info" %} Code-defined agents have a supply chain too. Review packages, tools, prompts, templates, and deployment gates together. {% endhint %} ## What security teams need to know about hosted-agent framework dependencies Hosted agents are software systems. They use packages, frameworks, tool registries, prompt templates, model providers, vector stores, and deployment pipelines. Each layer can change what the agent can see or do. The review should follow the dependency graph from source control to runtime. A safe prompt with an unsafe tool registry still creates risk. ## Common hosted-agent framework dependencies security failures * Tool registration changes without security review. * Prompt templates are edited outside source control. * Packages are unpinned or pulled from untrusted registries. * A new model provider is added without data-flow review. * Eval results are stored, but deployment is not gated on them. ## Hosted-agent framework dependencies security controls checklist * Pin packages and produce an SBOM for hosted-agent services. * Keep tool definitions, prompts, and templates in source control. * Require review for new tools, model providers, memory stores, and outbound destinations. * Use eval gates for high-risk workflows before release. * Log tool calls, model calls, retrieved context, and deployment version. ## Review the transitive runtime The framework is only the visible dependency. Include the model provider, agent and tool SDKs, MCP clients and servers, container base image, browser runtime, package manager, retrieval and memory services, telemetry exporters, policy libraries, and deployment templates. Pin where operationally feasible, monitor advisories, and record the update owner. For every material update, test authorization, tool schemas, sandbox behavior, network policy, secret handling, event fields, and stop behavior. A minor SDK or model change can alter tool invocation, retries, token use, and logging without changing the application code. ## Anthropic ### Overview For Anthropic hosted-agent frameworks, decide whether the team is building its own loop on the Messages API or using Claude Managed Agents. The Messages API path puts tool execution, state, retries, and deployment controls in the application. Managed Agents provide a hosted harness with agent definitions, environments, sessions, tools, MCP servers, skills, event streams, and cloud or self-hosted sandboxes. Dependency review should cover SDK versions, tool schemas, MCP server definitions, Agent Skills and their scripts, sandbox environment configuration, beta headers, vault credentials, self-hosted sandbox images, and multi-agent version pinning. Cloud sandboxes include preinstalled tools and disabled-by-default network access, so environment configuration belongs in the supply-chain review alongside code dependencies. Managed Agents is currently in beta, and because sessions persist conversation history and sandbox state server-side, it is not eligible for zero-data-retention arrangements today; put that in the data-flow review alongside network configuration. ### Anthropic documentation * [Tool use with Claude](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview) * [MCP connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector) * [Using Agent Skills with the API](https://platform.claude.com/docs/en/build-with-claude/skills-guide) * [Skills for enterprise](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise) * [Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview) * [Cloud sandbox reference](https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference) * [Multi-agent sessions](https://platform.claude.com/docs/en/managed-agents/multi-agent) * [API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) ## OpenAI ### Overview For OpenAI hosted-agent frameworks, the main code-defined path is the Agents SDK with platform tools, remote MCP, handoffs, guardrails, sessions, approvals, and tracing. Teams may also build directly on the Responses API and `tools` parameter, trigger Workspace Agents, use ChatGPT apps built with the Apps SDK, or embed Codex as a coding specialist through the Codex SDK or MCP server pattern. Dependency review should cover the Agents SDK package, generated or exported workflow code, tool wrappers, MCP server URLs, app servers, prompt and instruction files, eval datasets, tracing destinations, sandbox agents, credentials, workload identity, and deployment gates. Keep ChatGPT workspace controls, OpenAI API project controls, and Codex managed configuration separate in the review record. Note that OpenAI documents the standalone Evals platform as deprecated with a transition window, so gate new work on code-defined or Agents SDK-based evaluation rather than the legacy platform. ### OpenAI documentation * [Agents SDK](https://developers.openai.com/api/docs/guides/agents) * [Using tools](https://developers.openai.com/api/docs/guides/tools) * [Working with evals](https://developers.openai.com/api/docs/guides/evals) * [Workspace Agents](https://developers.openai.com/workspace-agents) * [Apps SDK MCP](https://developers.openai.com/apps-sdk/concepts/mcp-server) * [Codex SDK](https://developers.openai.com/codex/sdk) * [Codex MCP](https://developers.openai.com/codex/mcp) * [Codex managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration) * [Production best practices](https://developers.openai.com/api/docs/guides/production-best-practices) * [Workload identity federation](https://developers.openai.com/api/docs/guides/workload-identity-federation) ### Applicable Harmonic guides for OpenAI * [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice) ## Frequently asked questions about hosted-agent framework dependencies ### What is a hosted-agent framework? It is the code path for running agents as software services: the team owns the agent loop, tool registry, prompts, and deployment pipeline rather than configuring an agent inside a vendor UI. Examples include agents built on the OpenAI Agents SDK or Responses API, and Claude agents built on the Messages API or run through Claude Managed Agents. The security consequence is that supply-chain review shifts from vendor settings to your own dependency graph. ### What dependencies matter most for AI agents? Everything that can change what the agent sees or does: application and framework packages, tool registries and schemas, MCP server definitions, prompt and instruction templates, model providers, retrieval and memory stores, and the deployment pipeline itself. Any of these layers can alter agent behavior without a single line of application code changing. Pin and review them together, not just the packages. ### Should prompts be in source control? Yes, for production agents. Prompt and template changes can change agent behavior as much as code changes, so they need the same review, versioning, and rollback path. A diffable prompt history is also what lets incident responders explain a behavior shift after the fact. ### What is an eval gate? An eval gate is a deployment control that blocks a release unless the agent passes defined tests for safety, quality, and business behavior, such as resisting a prompt-injection test set or refusing out-of-scope tool calls. Build gates on your own evaluation harness or code-defined tooling; OpenAI documents its hosted Evals platform as deprecated, so new gates should not depend on it. ### What should an agent SBOM include? Beyond normal application packages: agent-framework packages, tool and MCP server packages, runtime images, prompt and template versions, and the major external services the agent depends on, such as the model provider, vector store, and tracing destination. The goal is that an incident responder can answer "which agents use this dependency?" in minutes. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.3 DORA and AI resilience in financial services | Conditional: for a DORA-regulated workflow, this supports ICT asset, dependency, and third-party risk management. | | G.5 SANS Critical AI Security Guidelines mapping | This article implements relevant SANS Deployment Strategies, Inference Security, and GRC guidance. | | G.6 Write an AI Acceptable Use Policy that holds up | This article supplies a technical or process control used to enforce the acceptable-use policy. | | G.7 Ownership and RACI for AI security | This control depends on the ownership and evidence responsibilities defined in the RACI. | | G.9 HIPAA controls for AI systems handling PHI | Conditional: for a workflow handling ePHI, this supports HIPAA approved vendors, business-associate review, data paths, and tool authorization. | *G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.* ## Related handbook guidance * [2. Supply Chain & Extensibility](/handbook/2.-supply-chain-and-extensibility.md) * [2.9 SaaS agent-building supply-chain](/handbook/2.-supply-chain-and-extensibility/2.9-saas-agent-building-supply-chain.md) * [2.8 Signing and packaging](/handbook/2.-supply-chain-and-extensibility/2.8-signing-and-packaging.md) * [3.9 Central hosted-agent runtime hardening](/handbook/3.-runtime-sandbox-and-autonomy/3.9-central-hosted-agent-runtime-hardening.md) * [5.3 Supply chain attacks and notable CVEs](/handbook/5.-threats-and-adversarial/5.3-supply-chain-attacks-and-notable-cves.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.10-hosted-agent-framework-dependencies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.