OWASP Top 10 for Agentic Applications (2026), Mapped to the DaloyJS Tool Surface

// The tool an AI agent calls is just a route. Schema + operationId
// is the contract. If the agent sends junk, the handler never runs.
import { z } from "zod";
import { App } from "@daloyjs/core";

export const app = new App();

app.route({
  method: "POST",
  path: "/tools/refund-order",
  operationId: "refundOrder",
  // The OpenAPI doc Daloy emits is what an agent (or MCP bridge)
  // discovers tools from. The contract is the single source of truth.
  request: {
    body: z.object({
      orderId: z.uuid(),
      // Bounded. An agent that "improvises" a 9999999.99 refund 400s.
      amountCents: z.number().int().min(1).max(50_000),
      reason: z.string().min(3).max(280),
    }),
  },
  responses: {
    200: { description: "refunded" },
    402: { description: "declined" },
  },
  handler: async ({ body, ctx }) => {
    // ctx.user is set by the auth slice. Tools never run unauthenticated
    // in this app - the auth middleware is mounted at app level.
    return refundService.refund(ctx.user, body);
  },
});

// ASI03 Tool Misuse + the AI-agent-SSRF risk in one line.
// fetchGuard() is default-deny on:
//   - cloud metadata (169.254.169.254, fd00:ec2::254)
//   - localhost (127.0.0.0/8, ::1)
//   - private ranges (10/8, 172.16/12, 192.168/16, fc00::/7)
//   - link-local (169.254/16, fe80::/10)
// An agent that prompt-injects "fetch http://169.254.169.254/..." into
// your tool's URL parameter gets a 403, not a stolen IMDS token.
import { App, fetchGuard } from "@daloyjs/core";

export const app = new App();

app.use(fetchGuard({
  // Explicit allow-list. Default-deny is the entire point.
  allow: [
    "https://api.stripe.com",
    "https://*.s3.amazonaws.com",
  ],
}));

// ASI04 Identity & Privilege Abuse, every tool authenticates,
// and the auth slice carries the principal into ctx with the
// privileges the tool is allowed to use.
import { App, jwt, timingSafeEqual } from "@daloyjs/core";

export const app = new App();

app.use(jwt({
  // JWT algorithm allowlist. 'none' is impossible. RS256/ES256 only -
  // HS256 confusion attacks die at the verifier.
  algorithms: ["RS256", "ES256"],
  jwksUri: process.env.JWKS_URI!,
  // Short-lived tokens. The agent should be re-issued credentials
  // per session, not handed a year-long key.
  maxTokenAgeSeconds: 15 * 60,
}));

// And when you DO compare a shared secret (webhook signature, API key),
// the framework's helper is constant-time. No early-return timing oracle.
const ok = timingSafeEqual(received, expected);

// ASI05 Inadequate Guardrails, high-blast-radius tools live on a
// SEPARATE App, on a separate deploy, behind ipRestriction +
// strong auth. The model-facing app cannot reach this code path.
import { App, ipRestriction, bearerAuth } from "@daloyjs/core";

export const adminTools = new App();

adminTools.use(
  ipRestriction({ allow: ["10.0.0.0/8"] }),
  bearerAuth({ verify: async (token) => verifyOpsToken(token) }),
);

adminTools.route({
  method: "POST",
  path: "/ops/refund-all",
  operationId: "refundAll",
  // A separate hostname keeps this route out of the public OpenAPI and
  // the agent's tool discovery.
  handler: async () => refundService.refundEverything(),
});

// ASI06 Sensitive Information Disclosure, production-mode error
// bodies are redacted. The agent gets an RFC 9457 problem+json with
// trace ID and a generic 'internal' detail. Stack traces, DB errors,
// internal hostnames, and connection strings never reach the wire.
//
// Logs go through redactRecord() - password / token / authorization /
// api_key / secret / cookie / set-cookie are all scrubbed before they
// leave the process. The structured request ID makes the redacted
// trace useful to your SIEM without leaking the credential.
import { App, secureHeaders, requestId, logger } from "@daloyjs/core";

export const app = new App();

app.use(requestId());                            // correlated trace IDs
app.use(secureHeaders());                        // CSP, COOP, COEP, X-CTO
app.use(logger({ redact: ["body.password"] }));  // additional fields
// NODE_ENV=production -> error bodies are redacted automatically.

// ASI07 Data Poisoning, every Standard Schema is .strict() by
// convention. Unknown fields are rejected, not silently merged into
// the validated value. A poisoned tool call that smuggles 'isAdmin: true'
// or '__proto__: {polluted: 1}' into a refund body never reaches the
// handler. The prototype-pollution guard rejects __proto__, constructor,
// and prototype keys at parse time.
import { z } from "zod";

const Refund = z
  .object({
    orderId: z.uuid(),
    amountCents: z.number().int().positive(),
  })
  .strict();   // <-- the difference between hardened and "vibes"

// ASI08 Denial of Service & Resource Exhaustion, the constructor
// already turned on:
//
//   bodyLimitBytes:    1_048_576       // 1 MiB. 413 before parsing.
//   requestTimeoutMs:  30_000          // 30s. Slow-loris dies.
//   compression cap:   8 MiB output    // zip-bomb-ish responses die.
//   header total cap:  the runtime cap // we don't extend it.
//
// On top of that:
import { App, rateLimit, loadShed } from "@daloyjs/core";

export const app = new App();

app.use(rateLimit({
  windowMs: 60_000,
  max: 30,                          // 30 req/min per IP per route
  // For multiple instances, bring the Redis adapter: same API, atomic INCR.
  // store: redisStore({ url: process.env.REDIS_URL! }),
}));

app.use(loadShed({
  // When the event loop lag > 200ms, shed low-priority traffic.
  // Agents looping on a failing tool stop wedging the box.
  maxEventLoopLagMs: 200,
}));

# ASI09 Insecure Supply Chain & Integration, the CI gates that ship
# in every create-daloy template and run on every PR.
pnpm verify:no-leaked-credentials       # AWS / GCP / GH / npm tokens
pnpm verify:no-lifecycle-scripts        # postinstall/prepare blocked
pnpm verify:no-remote-exec              # curl|sh, eval(fetch())
pnpm verify:no-encoded-payloads         # base64 smuggling
pnpm verify:no-invisible-unicode        # Trojan Source / bidi / ZWSP
pnpm verify:no-registry-exfiltration    # no POSTs to registry-shaped URLs
pnpm verify:no-runtime-deps             # @daloyjs/core has zero deps
pnpm verify:actions-pinned              # every GH action pinned by SHA
pnpm verify:lockfile-sources            # only registry.npmjs.org allowed
pnpm verify:dep-licenses                # license allow-list
pnpm verify:sbom                        # signed CycloneDX SBOM

# Plus a 24h minimum-release-age cooldown on every install. The next
# npm-cooldown-bypass typosquat does not land in your tree the same day
# the attacker publishes it.

// ASI10 Over-reliance, the framework can't make a human review the
// agent's output, but it can make the audit trail trivial. Every tool
// call is one structured log line with: request ID, principal, route
// operationId, body schema name, response status, latency, and (in
// dev) the redacted body. Pipe that to your SIEM and "what did the
// agent do at 3am" is a SQL query, not an archeology dig.
//
// For destructive tools, the recommended pattern is a TWO-step flow:
//
//   POST /tools/refund-order        -> returns { confirmationToken }
//   POST /tools/refund-order/confirm -> requires the confirmationToken
//                                       AND a human-approval token
//
// The framework doesn't enforce two-step - that's policy - but the
// typed route surface makes it the obvious shape to reach for.

// The "assume an unsupervised agent is calling every tool" defaults
// that the App() constructor turns on without asking.
//
// 1. Body-size DoS:         1 MiB cap -> 413
// 2. Request timeout:       30s -> 504
// 3. Proto pollution:       __proto__ / constructor / prototype stripped
// 4. Header splitting:      CRLF rejected at write time
// 5. Path traversal:        '..' / '//' / encoded NUL rejected at route time
// 6. Prod-mode redaction:   5xx bodies + logs scrubbed
// 7. Method confusion:      405 with Allow header (no 404 enumeration)
// 8. Unknown content type:  415, not silent JSON-parse of text/plain
// 9. Cookies:               __Host- prefix, Secure, HttpOnly, SameSite=Lax
// 10. Response body schema: 500 if a handler tries to return a shape
//     that doesn't match the declared response schema - so a buggy or
//     compromised handler can't leak fields the contract hid.
//
// Constructor:
new App();