# MCP and Agent security with Luke Hinds

Page: https://stenobird.com/podcast/open-source-security-518991/mcp-and-agent-security-with-luke-hinds
Text version: https://stenobird.com/podcast/open-source-security-518991/mcp-and-agent-security-with-luke-hinds.md
Podcast: [Open Source Security](https://stenobird.com/podcast/open-source-security-518991)
Published: 2026-03-16T00:00:00+00:00
Episode link: https://opensourcesecuritypodcast.libsyn.com/mcp-and-agent-security-with-luke-hinds
Audio file: https://traffic.libsyn.com/secure/opensourcesecuritypodcast/2026-03-mcp-agent-luke.mp3?dest-id=542864
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/open-source-security-518991/episodes/mcp-and-agent-security-with-luke-hinds
Duration seconds: 2136

## Resource

Josh talks to Luke Hinds, CEO of Always Further, about MCP and agent security. We start out talking about Luke's new tool, nono which is a sandboxing tool that has AI agents in mind as a use case. We explain what MCP and agents are doing as well as why it's so hard to secure them. It's not impossible, but it's not simple either. We end the show by discussing some of the more human aspects to security and how history may be repeating itself with security folks laughing at new users who don't know any better. The show notes and blog post for this episode can be found at https://opensourcesecurity.io/2026/2026-03-mcp-agent-luke/

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/open-source-security-518991/episodes/mcp-and-agent-security-with-luke-hinds/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/open-source-security-518991/mcp-and-agent-security-with-luke-hinds.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.