Attack surface
Every point where an attacker can try to send data into a system, get data out of it or act on it: endpoints, inputs, files, interfaces, dependencies, and the people and services with access. Reducing it removes paths instead of defending them.
- Defined in
- NIST glossary: attack surface
Covered in
Guide
Maintain an API inventory and prevent gateway bypass
Connect documented routes, deployed listeners and backend trust so retired or direct paths do not bypass the intended controls.
Guide
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Practice: Local project: Enforce retrieval and tool boundaries across crashes