An allowlist specifies exactly which tools, plugins, MCP servers, packages, and agents your agentic system is permitted to load. Anything not on the list is rejected before it runs — regardless of how legitimate it looks, how good its description is, or how trusted the registry says it is.
This is the most effective single control for preventing impersonation and typosquatting attacks. The Postmark impersonator would have been stopped by an allowlist that only permitted the specific, verified Postmark MCP server by its full package identifier and hash.
Pinning means locking every dependency to an exact version and a content hash — not just a version number. Version numbers can be republished with different content. A content hash (SHA-256) is immutable: if the package content changes, the hash doesn't match, and the load fails.
For npm: package-lock.json with integrity fields. For Python: pip install --require-hashes. For MCP servers: manifest hash stored in your AIBOM and verified at connection time.
Automated typosquat detection compares the names of packages an agent wants to install against known-legitimate packages using edit-distance and visual similarity algorithms. A package named postmark-mcp-servr would trigger an alert before installation. Tools like safety, pip-audit, and dedicated registry scanners implement this check.
For coding agents that autonomously install packages, typosquat scanning at the pre-install hook is non-negotiable.
Ask your team: if your AI agent automatically installs or loads a third-party package, is there an approved list it checks against first — or can it pull in anything? Ask whether package names are verified exactly, since attackers register names that are one typo away from legitimate ones.