Agentic Supply Chain Vulnerabilities: Your Agent Is Only as Secure as Its Weakest Plugin (ASI04)

This is post #4 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. You install an MCP server from npm. It says &ldquo;postmark-mcp&rdquo; on the label. Looks legitimate. Has a decent README. Your agent connects to it and starts routing emails through it. I&rsquo;ve built MCP integrations myself ( IFTTT MCP Proxy ). I know first-hand how easy it is to trust a tool descriptor…