Writing on prompt injection, LLM red-teaming, and EU AI Act compliance, from the team building Sentinel Scan.
The Annex IV file is usually written once and never updated, but Article 11 requires it to stay current. Why the gap opens, who finds it first, and how to link the file to evidence instead of memory.
All nine Annex IV sections as an actual fill-in template: what's checked, the common under-documentation gap, and a copyable prompt per section.
Nine sections, each with a concrete example of the kind of entry that would satisfy an auditor, next to the kind that wouldn't, and why.
What to check before trusting an MCP server, how it maps to the OWASP MCP Top 10, and a fair comparison of the scanners you can run today.
A reference table for 10 static manifest heuristics mapped to the OWASP MCP Top 10 (beta) and OWASP LLM Top 10, sourced verbatim from the scanner's code.
A factual, README-sourced comparison of three open-source MCP security scanners: what each scans, what it needs to run, and where each is actually stronger. No invented features, no benchmarks.
50% detection rate, 10% false positives, and the four attack categories (tool poisoning, indirect injection, cross-origin exfiltration, DoS) it misses entirely. Full methodology, fixtures, and results.
We statically scanned 45 public MCP servers' install manifests: 91.1% missing provenance, 86.7% unpinned remote source, 4.4% hardcoded credentials. Full methodology and dataset.
How much you can catch in an MCP server's tool manifest before ever running the thing, and where static scanning stops helping.
What each of the five open source tools people reach for actually does, where they overlap, and which one fits your situation.
All 10 heuristics in our static MCP manifest scanner, what each one actually checks, and an honest line between what pattern-matching can catch and what genuinely needs a running server.
Wiring sentinel-scan-cli into GitHub Actions and pre-commit as a real CI gate, including a gap I found in the CLI's exit code and the ten-line fix for it. Real command output throughout.
A hands-on run through scanning a real MCP manifest with a free static analyzer, reading what each finding means, and fixing them one at a time until the scan comes back nearly clean.
A prompt injection test tells you whether your model can be tricked into saying the wrong thing. It doesn't tell you what happens when that trick reaches an agent that can send an email, run code, or move money.
Enterprise buyers now attach an AI/LLM section to their SIG, CAIQ, or custom VSA. What the questions actually mean, and how to answer them honestly without stalling the deal.
A step-by-step process for finding injection paths in your own app before you ship: what to probe across chat, RAG, and tool outputs, and how to tell a real fix from a fragile one.
"Slopsquatting" just showed up in the wild: attackers registering real packages under names AI coding agents hallucinate. Why it's the same trust-boundary bug as prompt injection, and how to check for it.
What actually reduces prompt-injection risk in a shipped LLM feature, and what Annex IV documentation requires now that the EU AI Act's high-risk deadlines have moved.
Annex IV's nine sections, translated from legal drafting into what a compliance lead or product owner actually needs to go find and write down.
A written AI disclosure policy isn't enough on its own. What agency owners need in the policy, why EU AI Act transparency obligations require proof not just intent, and a free generator to draft yours.