$ whoami

Avneesh
Kasture

solutions engineer / agentic security

I'm a solutions engineer on Gruve's professional-services team, building secure MCP servers for enterprise clients — hardening the agentic layer against prompt injection, tool misuse, and privilege abuse. Alongside that, I ship internal apps the company's teams use day to day.

selected work my résumé is an MCP server get in touch

// 01 · about

I make the agentic layer safe to ship.

Most "AI security" is a line in the system prompt asking the model nicely. I don't buy it. Give an agent tools and the question that matters isn't whether it behaves. It's what happens when it doesn't, and whether anything in the actual code is there to stop it.

So I build the boring half on purpose: the allowlist, the identity check, the output scan, the audit line, all in the server where a payload can't argue with them. Same rule for the internal tools I ship for the company — doc generation, pricing, analytics — every number tracing back to where it came from.

// 02 · how i work

How I harden an MCP server

  1. 01

    Threat-model the agentic layer first

    Before any tool code: map what the model could be coerced into — prompt injection via tool results, tool misuse, privilege escalation, data exfiltration — and design controls against that, not against the happy path.

  2. 02

    Least privilege, enforced in code

    Scope the server to the minimum endpoints the use cases need, and reject everything else at runtime with a real allowlist — not a note in the prompt the model can be talked out of.

  3. 03

    Identity on every call

    Verify the caller's token — signature and claims — on every tool invocation, and bind that identity to every action so nothing runs anonymously.

  4. 04

    Untrusted output, scanned before the model sees it

    Tool output is structured, isolated from the system prompt, and DLP-scanned so PII and secrets never enter the conversation history.

  5. 05

    Audit every action to its cause

    Each tool call is a structured record — who, what, which endpoint, and a hash of the prompt that triggered it — so an incident can be reconstructed, not guessed at.

→ See all ten mapped: the OWASP Agentic Top 10, and the control that stops each

// 03 · case study

A secure-by-default MCP framework, built for a client

The threat model starts from an uncomfortable premise: the model will be jailbroken. Researchers like Pliny the Liberator break new frontier models within hours of release — so if a customer's data is protected only by the model choosing to behave, it isn't protected at all. I've measured this in my own lab: in mcploitable, every guardrail that depends on the model recognizing an attack fell on at least one model I pointed at it. A control you escape by swapping models isn't one. The server-side check behind them refused every payload, whichever model was driving.

A client needed to connect internal AI agents to enterprise systems over MCP without betting company data on model compliance. I built them a secure-MCP development framework and a tested Python scaffold that makes the secure path the default one — driving every build through intake → auth design → endpoint governance → an auto-generated threat model → code from a hardened scaffold → a security-readiness gate before delivery.

Threats it designs against, and the control that answers each:

  • Prompt injection via tool resultsstructured returns, output isolated from the system prompt, DLP-scanned
  • Tool misuse / scope creepruntime endpoint allowlist — non-approved calls rejected in code
  • Secret leakageOS keychain / vault only — never in .env or on disk
  • Identity spoofingOAuth 2.1 + PKCE — JWT signature + claims verified on every call
  • Untraceable actionsstructured audit log tying every action to a hash of the prompt that caused it

Outcome: every MCP the framework produces ships with the same non-negotiable controls and must pass a security-readiness checklist before delivery — a repeatable, auditable process instead of per-project guesswork. (Delivered through my professional-services role at Gruve. Client and proprietary internals anonymized.)

→ Try to break one in your browser

// 04 · experience

Where I've worked

  1. Professional Services · Solutions Engineer

    Gruve Apr 2026 — Present · Pune

    Design and deliver secure MCP servers for clients: the threat model, a hardened Python scaffold, and a security-readiness gate every build passes before it ships. Alongside delivery I build the internal tools the company runs on, including Helix (card below).

  2. Security Operations Center Analyst

    Gruve Apr 2025 — Apr 2026 · Pune

    Advanced triage and investigation of security alerts across network, endpoint, and authentication telemetry using Splunk and CrowdStrike Falcon. Conducted threat hunting that identified a vulnerability and led to a customer-wide advisory report.

  3. Digital Forensics Intern

    Deloitte Jul 2024 — Feb 2025 · Mumbai

    Forensic acquisition and analysis of digital media using industry-standard tools. Streamlined business-critical processes to cut processing time by 80%, and automated virus scanning and image documentation with Python (RPA).

// 05 · selected work

Things I've built

agentic-security · CTF lab · Python

mcploitable

The "Metasploitable of MCP" — deliberately vulnerable MCP servers, one per class of the OWASP Top 10 for Agentic Applications. Seven are breakable boxes on an L0→L3 control ladder (open door → recognition signal → bypassable control → the deterministic wall), scored by real effect — you win only when a canary secret actually leaves via a tool call. The other three ship as guided simulations. Recognition and partial controls fall to a good payload. The wall holds by construction: 105 attempts, zero through, and no 106th changes that.

play in-browser github ↗ the thinking
agent-safety · provenance · Python

d2c-analyst

A working AI analyst plus an autonomous Margin Watch agent for D2C brands. Every number in an answer is server-side validated against a provenance model before it reaches the user. A gpt-4o-mini → gpt-4o router escalates on complexity, all over row-level-secure multi-tenant data. Built, tested, and documented end to end.

github ↗
platform · private

Helix @ Gruve

Internal AI sales-enablement platform. A GPT-4o SOW generation pipeline, automated pricing calculator, engineering capability roadmap, and Service Navigator — Express.js, PostgreSQL, Redis, Prisma on Azure.

helix.gruveai.com ↗ live · Entra-gated
security tooling · NLP · Python

PIIDetector

A filesystem-level PII detection tool that scans images, text, Word docs, and PDFs for sensitive-data exposure, enhanced with NLP-based entity recognition for structured and unstructured PII patterns.

github ↗
research · cryptography

Randomness Testing Suites

A comparative analysis of randomness-testing algorithms and suites — methodology and results written up as a research draft.

read draft ↗ github ↗
for fun

Seinfeld Excuse Rolodex

A tiny toy that generates an excuse for every day of the week. Kept around because it still makes me laugh.

open ↗

→ The lab: six interactive exhibits — a server, a sandbox, a matcher, a poisoned tool, the map, and you as the model

// 06 · skills

Toolkit

Secure MCP & Agentic

  • MCP server design
  • OWASP Agentic Top 10
  • Prompt-injection defense
  • Tool scoping & sandboxing
  • Client delivery

AI & Automation

  • LLM workflow orchestration
  • Document-generation pipelines
  • Citation / provenance validation
  • Tool-use / function calling
  • SOAR / playbook automation

Build & Ship

  • Python
  • Docker
  • Internal app development
  • REST & API integration
  • LLM app plumbing

Security Foundations

  • Threat Hunting
  • Detection Engineering
  • Splunk · CrowdStrike Falcon
  • Windows Forensics
  • Malware Analysis

Certifications

Education

  • B.Tech, Computer Science & Engineering
  • Vellore Institute of Technology · 2024

Community

  • Enactus — VIT Chennai Chapter

// 07 · contact

Get in touch.

apkasture02@gmail.com github / agileAlligator linkedin résumé (pdf)