Give an MCP-enabled AI agent only the tools, data, and operations needed for its current task. Prefer read-only access when it is enough, enforce authorization on the MCP server for every request, and require human approval for sensitive or consequential actions. Keep credentials narrowly scoped, and assume that content returned by tools—or supplied by users—could contain prompt injection.
Start with the least access the task can use
Set permissions for the specific job, not for what the agent might need someday. If the task is to find a document, grant access to search and read the relevant documents; do not also grant edit, delete, or sharing tools unless the task requires them. Limit which records, accounts, or tenants the credentials can reach, too.
As an Amazon Associate I earn from qualifying purchases.
Prefer read-only access whenever it can complete the work. If the task changes—for example, from drafting a message to sending it—reassess the permissions rather than carrying forward a broad grant. There is no universal MCP permission list: the appropriate scope depends on the task, connected data, credential model, and possible side effects.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enforce authorization at the server
A tool allowlist controls which tools the agent can see or call through a given client, but it does not replace authorization. The MCP server must authenticate and authorize each request, including checking whether the caller may access the requested resource or perform the requested operation. OpenAI’s server-building guidance explicitly says not to rely on the model to decide whether a user has access: Build an MCP server – Plugins.
#1 Best Overall
- More for the money with this high quality Product
- Offers premium quality at outstanding saving
- Excellent product
- 100% satisfaction
Keep the distinction clear: tool availability limits the interface presented to the agent; server-side authorization decides whether a particular call is permitted. A prompt such as “do not access other users’ records” is not an access-control mechanism.
Scope and protect credentials
Use credentials limited to the intended MCP server, resource, and task. Do not place access tokens in URLs; the OpenAI Agents SDK guidance recommends keeping them in authorization fields or headers and using least-privilege credentials. See its MCP documentation.
For OAuth-based authorization, follow the applicable protocol requirements. The MCP authorization specification dated 2025-06-18 says servers must validate access tokens before processing requests and ensure that a token was issued specifically for that MCP server. It describes OAuth resource indicators as a way to bind tokens to their intended audience where supported, and PKCE as protection against authorization-code interception and injection. Consult the MCP authorization specification for the relevant flow and requirements.
Require approval when a call could have serious effects
Use an approval step for operations that could expose or change important data, especially writes, modifications, deletions, external sends, or actions that are difficult to reverse. Match the approval threshold to the possible impact: reading a low-sensitivity record is different from deleting records or sending a message outside the organization.
Rank #3
- Product type: Screw kit
- Made by Super Micro
- Manufacturer part number: MCP-410-00005-0N
- Supermicro MCP-410-00005-0N Screw Bag(100PCS) and Label for 24x Hot swap
- Mfr Part Number: MCP-410-00005-0N
Approval and authorization are separate controls. Approval gives a person a chance to review a call; server-side permissions still define what the credential can access. Apply both where warranted. OpenAI’s Agents SDK documents per-tool approval policies, and its MCP API guidance describes using require_approval and allowed_tools to control sensitive actions. The Responses API’s approval behavior and client options can change, so check the current documentation before relying on a particular default.
OpenAI Help Center guidance also notes that confirmation for write or modify actions can depend on app permissions, context, and potential impact; see Developer mode and MCP apps in ChatGPT.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Assume tool output can try to manipulate the agent
Prompt injection can arrive in external content or in tool results. If the agent can read sensitive information or take actions, hostile content may try to steer it toward exposing data or making an unauthorized change. Treat returned content as untrusted input, keep permissions narrow, and use enforced approval for consequential operations. Do not rely on an instruction in the prompt as the only safeguard.
Microsoft for Developers reported a 26.67% policy violation rate in its own internal red-team evaluation of prompt-only safety instructions in 2026. That figure describes Microsoft’s evaluation, not a general violation rate for MCP deployments. Its article argues for deterministic controls that can allow, deny, or require approval for each tool call: Securing MCP: A Control Plane for Agent Tool Execution.
Choose permissions by considering impact
Before connecting an agent, assess the task along these dimensions. They are practical decision factors, not a universal MCP permission template.
- Data sensitivity: Could the tool expose personal, confidential, or otherwise restricted information?
- Operation type: Does the task need only to read, or also to write, modify, delete, or send?
- Reversibility: Can an erroneous action be undone, and would undoing it fully address the harm?
- Account or tenant scope: Which users’, projects’, or organizations’ resources can the credential reach?
- Impact if manipulated or mistaken: What could happen if the call is triggered by incorrect reasoning or hostile content?
Google Cloud’s MCP security guidance highlights that agent-mediated actions can include non-reversible changes and recommends an agent identity with only the roles and permissions necessary for its tasks.
Quick Recap
A practical permission pattern
- Define the task: List the data the agent needs and the operations it must perform.
- Limit tools and scope: Allow only the necessary tools, resources, accounts, and operations; start read-only if that is sufficient.
- Enforce the boundary server-side: Authenticate and authorize every request rather than trusting the model or its instructions.
- Protect the credential: Use a narrowly scoped credential for the intended server and resource, and keep tokens out of URLs.
- Gate consequential calls: Add human approval for sensitive, external, destructive, or hard-to-reverse actions.
- Reassess when the job changes: Expand or reduce access only when the task requires it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
