MCP Least Privilege

An MCP server is not ready for production until it operates under least privilege per tool: each tool gets exactly the access its function requires, and no server is connected "because we might need it." If a server has omnibus permissions or is connected without a defined use case, stop and scope it down.

MCP servers are the privilege boundary. The agent on the other side is a credentialed principal at machine speed.

When to run

• Designing a new MCP server
• Auditing an existing MCP server before production rollout
• Investigating a security incident involving an MCP server
• Setting up multi-server orchestration

If you cannot name the specific permissions each tool requires, the server is not scoped.

The MCP security model

MCP itself does not enforce security — it delegates all responsibility to implementers. The current standard for remote HTTP-based MCP servers is OAuth 2.1 with PKCE.