CAIN-42 CAIN StudioCMSE · Module 3 of 5 · 12 min
Least privilege for MCP servers and tokens
Most MCP damage comes from tools that can do far more than their task needs: a 'read calendar' tool backed by a token with mail-send scope, a filesystem tool rooted at /.
Scope each tool to the smallest resource set, narrow parameter schemas (enums, patterns, max lengths), and never let the server hold long-lived broad credentials the agent can trigger indirectly.
At the boundary, require a per-call capability token so even a compromised agent cannot replay or widen a permission.
Key points
- Smallest resource set per tool.
- Tight schemas: enums, patterns, limits.
- No broad standing credentials.
- Per-call tokens at the boundary.
In the CAIN-42 codebase
cain/mcp_proxy.py— MCPGate boundary with single-use capability tokens
Practice check
Practice 1 · true or false
“A filesystem tool rooted at / follows least privilege.”
Practice 2 · choose one