AI Security Atlas › All entries › Autonomous Agent & MCP Security
MCP Permission Scoping
Least-privilege capability tokens and server-side allowlists constrain every MCP tool invocation.
Open in the interactive atlas →Impact
Limits blast radius when an agent is steered into hostile tool use.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Excessive Tool Permissions (Critical), Unbounded MCP Tool Calls (Medium).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Excessive Tool Permissions Vulnerability · Critical severity
- Unbounded MCP Tool Calls Threat · Medium severity
Needed by
- Dual-Agent Approval Loop Guardrail · Fixes high risks
Remediation
- Map each tool to a capability profile (read / write / admin).
- Rotate short-lived tokens per session and revoke on anomaly.
- Publish a permission matrix reviewed in change control.
How to verify
- CI gate fails if a tool requests scopes outside its profile.
- Runtime denies cross-profile invocations with auditable events.
Pattern
assertScopes(session.token, tool.profile);
await invoke(tool, args);Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM06:2025 Excessive Agency
OWASP Top 10 for Agentic Applications 2026
- ASI03:2026 Identity and Privilege Abuse
MITRE ATLAS
- AML.M0028 AI Agent Tools Permissions Configuration
- AML.M0026 Privileged AI Agent Permissions Configuration
NIST AI RMF 1.0
- MAP 4.2 Internal risk controls for AI components are identified and documented