The Lethal Trifecta, a concept from security researcher Simon Willison, describes three conditions that create an exfiltration risk: agents with access to private data, exposure to untrusted content, and the ability to communicate externally. When all three are present, attackers have a path to steal data. MCP servers inherently satisfy the first two conditions by design. The Aviatrix-Obot partnership focuses on breaking the third leg by controlling where MCP servers can send traffic, stopping unauthorized external communication at the network level.

What is the "Lethal Trifecta" and why does it matter for AI agents?

An MCP server handles requests for data on behalf of AI agents. For example, an MCP server might retrieve patient records from a healthcare system when an agent needs that information. The security concern is that by default, an MCP server can reach anything its host can reach. Most enterprises are running more MCP servers than they realize, and each one represents an ungoverned egress path. Traditional tools like Kubernetes NetworkPolicy and service meshes often lack the visibility to catch unauthorized traffic from these servers.

What is an MCP server, and why is it a security concern?

Obot governs which MCP servers an AI agent is allowed to call. Aviatrix governs where those servers can send traffic over the network. Security teams set FirewallPolicy CRDs that define allowed and blocked destinations for each server. Traffic from each MCP server passes through Aviatrix spoke gateways, where an eBPF dataplane evaluates policies inline and drops disallowed egress before it leaves the cluster. This requires no code changes, no sidecars, and no per-pod resource overhead. Policies propagate across clouds and environments automatically.

How does the Aviatrix-Obot partnership actually work?

For regulated industries under frameworks like HIPAA, PCI-DSS, and SOC 2, auditors need architectural proof of enforcement, not just a policy document. FirewallPolicy CRDs are Kubernetes objects that live in git, can be inspected with kubectl, and are tracked in the Kubernetes audit log. Security policy ships in the same repository as the deployment manifest, reviewed in the same pull request, and deployed in the same pipeline. This creates a verifiable, auditable record that enforcement is built into the architecture itself.

How does this partnership help with compliance requirements?

This partnership provides three capabilities that standard tools lack. First, it offers granular containment where two MCP servers in the same namespace can receive different egress policies based on pod labels. Second, it eliminates policy debt because deleting an MCP server automatically triggers cleanup of its associated firewall rules. Third, the same FirewallPolicy CRD works across AKS, EKS, and GKE without rewriting policies for each cloud. Enforcement runs at the spoke gateway's eBPF dataplane, delivering service-mesh-level control without the operational overhead of sidecars.

What makes this approach different from existing network security tools?

Aviatrix-Obot Partnership new

The Aviatrix-Obot partnership offers customers enterprise-grade security for MCP servers, empowering safe agentic AI use.  

Nick Davitashvili

Author Biography

Published Articles by Nick Davitashvili

Announcing the Aviatrix-Obot Partnership: Securing MCP Servers

Products

By Role

Customer Stories

Security & Legal

Solutions

Resources

Industry

Company

Tools