MCP permission scoping
An MCP server is a tool surface exposed to an untrusted planner. Permissions should be declared per tool, denied by default, and enforced by the server rather than trusted from the client.
What is MCP server permissions?
An MCP server is a tool surface exposed to an untrusted planner. Permissions should be declared per tool, denied by default, and enforced by the server rather than trusted from the client.
Implementation
- Declare each tool's read/write nature in its annotations and enforce it in the handler.
- Deny network egress a tool has not declared.
- Never read ambient credentials inside a tool that a public caller can reach.
- Return structured content with a fixed schema so callers cannot be steered by free text.
- Log every invocation with caller identity, arguments, and duration.
defineTool({
name: "list_projects",
inputSchema: {},
annotations: {
readOnlyHint: true,
idempotentHint: true,
openWorldHint: false,
},
handler: () => ({ structuredContent: { projects } }),
})Failure modes
- A tool that reads process env and returns it in an error message.
- Write tools exposed on a public server with no caller verification.
- Free-text tool output that carries instructions into the planner's context.
How it is verified
- Enumerate the live tool list and confirm every entry is intentional.
- Attempt an undeclared operation and confirm it is refused.
Questions this pattern answers
What is MCP server permissions?
An MCP server is a tool surface exposed to an untrusted planner. Permissions should be declared per tool, denied by default, and enforced by the server rather than trusted from the client.
How do you implement MCP permission scoping?
Declare each tool's read/write nature in its annotations and enforce it in the handler. Deny network egress a tool has not declared. Never read ambient credentials inside a tool that a public caller can reach. Return structured content with a fixed schema so callers cannot be steered by free text. Log every invocation with caller identity, arguments, and duration.
How is MCP permission scoping verified?
Enumerate the live tool list and confirm every entry is intentional. Attempt an undeclared operation and confirm it is refused.
What usually goes wrong with MCP permission scoping?
A tool that reads process env and returns it in an error message. Write tools exposed on a public server with no caller verification. Free-text tool output that carries instructions into the planner's context.
Projects in this track
ClawKeeper →
Governed Claude agent control plane. A deterministic policy engine runs before every LLM call, autonomous spend defaults to zero, and the audit log is enforced by the database.
TechTide Harness Kit →
Trust contracts for agent skills expressed as JSON Schema: risk tiers, tool permissions, deny-by-default egress, approval gates, and prompt-injection fixtures behind a wall of CI validation gates.
CipherClaw →
Deterministic multi-agent debugger with zero LLM calls in the analysis path: causal graphs, weighted root-cause scoring, and failure prediction.
Swarm 357 →
357 Claude agent roles across six business layers, with portable memory, enforced cost caps, a bash policy gate, and durable checkpoints.
Related patterns
This page documents how the pattern is built. Engagement scope and pricing live on TechTide AI.
AI Production Systems at TechTide AI→© 2026 Alex Cinovoj · TechTide AI · Columbus, OH