fix: OWASP AI Agent Security hardening for chat and MCP endpoints

[BenjaminMichaelis]

Summary

Implements all actionable findings from an OWASP AI Agent Security Cheat Sheet review of the chat and MCP subsystems. The implementation was reviewed in two rounds by GPT-5.5 and Claude Opus 4.6, which found and resolved additional issues before this PR was created.

Fixes: #1064
Fixes: #1066
Fixes: #1067
Fixes: #1068
Fixes: #1069
Fixes: #1070
Fixes: #1071

[Copilot]

Pull request overview

This PR applies OWASP AI Agent Security hardening across the chat and MCP tool-call paths by adding prompt trust-boundary framing/sanitization, MCP tool allowlisting, per-user response-id validation, and MCP token issuance limits.

Changes:

• Hardened prompt enrichment by sandboxing retrieved vector-search content inside explicit <retrieved_context> boundaries and sanitizing/truncating retrieved chunks.
• Added a config-driven MCP tool allowlist and enforced it both when advertising tools to the model and before executing tool calls.
• Reduced client-side persistence risk and added server-side validation to bind previousResponseId to the authenticated user; added a per-user active MCP token cap.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
EssentialCSharp.Web/wwwroot/js/chat-module.js	Moves lastResponseId persistence to sessionStorage and adds a short TTL for local chat history.
EssentialCSharp.Web/Services/ResponseIdValidationService.cs	Adds server-side tracking/validation of response IDs per user using IMemoryCache.
EssentialCSharp.Web/Services/McpApiTokenService.cs	Adds active-token counting and introduces MaxTokensPerUser.
EssentialCSharp.Web/Program.cs	Registers memory cache and the response-id validation service.
EssentialCSharp.Web/Controllers/McpTokenController.cs	Enforces per-user active MCP token cap before issuing new tokens.
EssentialCSharp.Web/Controllers/ChatController.cs	Validates client-supplied previousResponseId, records issued response IDs, and plumbs endUserId.
EssentialCSharp.Web/appsettings.json	Updates system prompt to treat <retrieved_context> as untrusted data; adds MCP tool allowlist.
EssentialCSharp.Chat/Program.cs	Passes a concrete endUserId into chat calls (console host).
EssentialCSharp.Chat.Shared/Services/AIChatService.cs	Implements retrieved-context sandboxing, MCP allowlist enforcement, and AI security logging; plumbs endUserId.
EssentialCSharp.Chat.Shared/Models/AIOptions.cs	Adds AllowedMcpTools and AllowAllMcpTools configuration options.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 7 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

EssentialCSharp.Web/wwwroot/js/chat-module.js:70

• saveChatHistory() only writes aiChatLastResponseId to sessionStorage after localStorage.setItem(...) succeeds. If localStorage throws (quota exceeded, blocked, etc.), the catch/fallback path never updates sessionStorage, so lastResponseId persistence can become stale or be lost on reload even though sessionStorage is still available. Consider updating/removing the sessionStorage key in a finally (or duplicating the sessionStorage write in the catch) so lastResponseId is persisted independently of localStorage success.

        try {
            // Limit messages to prevent memory issues (keep last 100 messages)
            const maxMessages = 100;
            const messagesToSave = chatMessages.value.slice(-maxMessages);
            
            const data = {
                messages: messagesToSave,
                timestamp: Date.now()
            };
            localStorage.setItem('aiChatHistory', JSON.stringify(data));
            // Store lastResponseId in sessionStorage — it clears on tab close, reducing persistent exposure
            if (lastResponseId.value) {
                sessionStorage.setItem('aiChatLastResponseId', lastResponseId.value);
            } else {
                sessionStorage.removeItem('aiChatLastResponseId');
            }
        } catch (error) {
            console.warn('Failed to save chat history:', error);
            // If localStorage is full, try clearing and saving only recent messages
            try {
                const recentMessages = chatMessages.value.slice(-20);
                const fallbackData = {
                    messages: recentMessages,
                    timestamp: Date.now()
                };
                localStorage.setItem('aiChatHistory', JSON.stringify(fallbackData));
            } catch (fallbackError) {

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

[BenjaminMichaelis]

@copilot resolve the merge conflicts in this pull request