What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
MCP lets a client discover tools and send a model-selected call to a server. What it does not establish by itself is whether that specific call—with those arguments, for that user, at that moment—is safe and authorized. A host, gateway, or equivalent runtime enforcement point must make that decision before execution, independently of the model’s choice.
What happens between selection and execution?
The sequence has three distinct decisions:
- Discovery: an MCP client obtains tool definitions from a server and makes available tools visible to a model.
- Selection: the model proposes a tool and arguments in response to the task.
- Authorization: a runtime policy determines whether that proposed call may proceed, must be denied, or needs human approval.
OpenAI’s remote MCP connector documentation describes importing tool definitions, model selection, and an approval-request flow in which a person can review the proposed tool and arguments. The key security boundary is before the server performs the action: discovery and selection identify a possible capability, but neither grants permission to use it.
As an Amazon Associate I earn from qualifying purchases.
Microsoft frames the gap as the interval between a model deciding to call a tool and the call being validated as permitted, properly scoped, and auditable. Its recommended pattern is deterministic evaluation for each call, with an explicit allow, deny, or approval outcome. This is an architectural recommendation, not a feature guaranteed by every MCP client.
Why authentication alone is not enough
Authentication can establish which user or client is connected, while server-side authorization can restrict access to resources. Neither automatically answers whether this particular action is appropriate in context. A user may be authenticated and still have a proposed call that exceeds the task’s intended scope, uses overly broad credentials, or targets a sensitive resource.
#1 Best Overall
A per-call policy can consider the authenticated user and agent, server and tool identity, argument values, credential scope, resource sensitivity, side effects, and current session rules. There is no single universal policy schema prescribed by the sources; these are design dimensions for a deployment to define and enforce.
Threats that can influence a tool call
- Tool poisoning: misleading or adversarial text in a tool definition can influence which capability the model chooses or how it behaves. OWASP categorizes this as MCP03.
- Prompt injection in results: returned content or retrieved data can contain instructions that affect the model’s next decision. OWASP categorizes this as MCP06; Microsoft describes how instructions in one tool’s output can propagate into a later call.
- Unsafe execution: commands, API requests, or code assembled from untrusted input can create command-injection or execution risks. OWASP categorizes this as MCP05.
- Weak authorization and over-sharing: broad identities or excessive context can expose data or enable actions beyond the user’s intent. OWASP categorizes insufficient authentication and authorization as MCP07 and context over-sharing as MCP10.
- Supply-chain and shadow-server risks: unapproved, compromised, or lookalike servers can enter the tool set. Inadequate audit and telemetry can make subsequent investigation harder.
OWASP’s risk taxonomy identifies these categories; it does not quantify how often they occur. The MCP project also cautions that tool annotations are hints and should be treated as untrusted by default. Its March 2026 discussion described some trust- and sensitivity-related annotation ideas as proposals or drafts, not universal enforcement features: MCP project announcements.
Controls that belong in a secure execution path
Limit what the model can select
Register servers through an approved process, review definitions, and expose only the tools needed for the task. OpenAI documents the allowed_tools configuration and recommends preferring official provider-operated servers where available. It also warns that remote servers may contain hidden prompt injections or change behavior. A narrower tool set reduces exposure, but does not replace per-call authorization.
Enforce a policy before consequential calls
At the host, gateway, or equivalent runtime boundary, evaluate the identity, tool, arguments, permissions, and action sensitivity using deterministic code or policy infrastructure. Do not rely on the model to police its own proposed action. Return a clear allow, deny, or approval-required result and prevent the server from acting until the decision is complete.
Make approval specific and reviewable
For sensitive side effects, show the person the actual requested tool and arguments before approval. An approval should apply to that call, not become a blanket permission for later actions. OpenAI’s documented flow supports individual approval requests; its guidance also recommends reviewing what data will be shared with a server.
Constrain credentials and shared data
Use least-privilege credentials and appropriate access controls. Consider which user or resource data leaves the host, and whether the selected server needs it. This limits the consequences of an overly broad call and addresses OWASP’s authorization and context over-sharing risks.
Treat returned content as untrusted
Tool results may contain useful data, malicious instructions, or both. Inspect or constrain outputs where appropriate, and do not let text returned by a tool silently authorize a later sensitive action. A subsequent call needs its own policy decision.
Keep an audit trail
Record calls, relevant policy decisions, approvals, and material context changes. Useful records make it possible to reconstruct what was requested, what was allowed, and what the tool did. OWASP identifies lack of audit and telemetry as a risk category.
Handle changing definitions and cache freshness
A cached tool list may become stale or be unsafe to share across contexts. The MCP project’s July 28, 2026 specification-release article describes ttlMs and cacheScope metadata for list responses, which clients can use when deciding freshness and safe sharing. These details depend on the protocol version implemented by the client and server; freshness metadata does not authorize a consequential call. See the MCP specification release article.
How the main control approaches differ
| Approach | Where the decision occurs | What it contributes | Limit to account for |
|---|---|---|---|
| Model instructions alone | In the model’s instructions and behavior | Simple to add as guidance | Not an independent enforcement boundary. Microsoft’s internal evaluation found policy violations despite prompt-only safety instructions. |
| Per-call human approval | Before the specific call proceeds | Lets a person inspect the tool and arguments | Requires a clear review interface and must be applied to the actual sensitive call. |
| Host or gateway policy | At runtime, before execution | Can make deterministic allow, deny, or approval decisions and centralize audit records | Must be implemented and configured; MCP itself does not guarantee this layer. |
| Server-side authorization | At the server when access is requested | Protects server resources and checks access rights | Does not necessarily decide whether the action is acceptable in the user’s current context. |
Microsoft reported a 26.67% policy-violation rate for prompt-only safety instructions in an internal 2026 red-team evaluation of 60 prompts—45 adversarial and 15 valid—mapped to the OWASP Agentic Top 10. That vendor-reported result supports a limited conclusion: prompt-only instructions were insufficient in that evaluation. It is not a prevalence estimate or a universal failure rate for MCP deployments. Microsoft’s article, by Jack Batzner, states: “What’s missing is a built-in checkpoint that can answer a simple question before execution: is this agent allowed to invoke this tool, with these arguments, at this time?” Read the Microsoft article on MCP execution governance.
Protocol version matters
The MCP project’s July 28, 2026 release article describes authorization changes including validation of the OAuth response iss parameter before a client redeems a code, issuer binding for client credentials, and formal deprecation of Dynamic Client Registration in favor of Client ID Metadata Documents, while retaining DCR for backward compatibility. It also describes cache metadata for tool-list and related responses. These are version-specific protocol details: verify which version a deployment implements rather than assuming every client or server has adopted them.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →OpenAI’s connector documentation describes remote calls over supported HTTP transports and configurable approvals. Protocol authorization, server permissions, and host-level action policy serve related but distinct purposes: a deployment should not treat one as a substitute for the others.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
