AGENTFORCE-24.2: Missing Signature Validation on Agent Webhook

🔴 High · MCP Authentication

Detects @RestResource Apex endpoints accessible to agent actions that do not implement HMAC signature verification. Without signature validation, any caller can forge webhook payloads to invoke agent actions outside the intended security context.

Details

Field	Value
Rule ID	AGENTFORCE-24.2
Severity	High
Category	MCP Authentication
Compliance	OWASP_MCP_TOP_10, SOC2_CC7

Remediation

Refer to the SquireX documentation for remediation guidance specific to AGENTFORCE-24.2.

See Also

• Rule catalog index
• SquireX scan documentation