MCP least privilege

An MCP server is a privilege boundary: each tool gets only the access its function needs, each token is checked as issued for this server, and nothing is connected "because we might need it". This skill is the server owner's side; which tools an agent may call at all is tool-allowlist.

Quoted text is the MCP authorization spec, revision 2026-07-28, keywords as written. Unquoted guidance is engineering practice.

Probe a server first

node scripts/probe-mcp-auth.mjs https://mcp.example.com/mcp          # human report
node scripts/probe-mcp-auth.mjs https://mcp.example.com/mcp --json   # machine report
node scripts/probe-mcp-auth.mjs http://127.0.0.1:3000/mcp --allow-http

Zero dependencies, Node 18+. Exit 0 all pass, 1 a check failed, 2 not probeable (connection error, non-HTTP URL, bad arguments). It sends an MCP initialize POST with no credentials, the same POST with the dummy bearer token probe, and the same POST with ?access_token=probe. Metadata comes from the advertised resource_metadata URL, or from endpoint-path then origin-root well-known URIs when that parameter is absent. It refuses URLs that carry userinfo or a credential-like query parameter, never reads the environment, and does not follow redirects.