Tool cleanup_stale_records

A tool AI agents call, on the MCP server Example Corp assistant.

No approved baseline: nobody approved this tool's scopes.

Says about itself

None

Calls

None

Scopes it holds

admin, records:delete

• Critical The tool relies on a scope that grants everything

  The token behind this tool opens every operation of the system, not only what the tool does. An agent turned against its user can reach all of it without any new consent.

  Scopes concerned: admin

  ScopeNeat recommendation: Map the tool to the narrow scopes its calls need, and request the others only when a riskier action is attempted.

  Next step: The developer maps the tool to the narrow scopes its calls need, and the resource owner approves the new mapping with security consulted.

  Accountable Resource owner

  Sources: Published security guidance

  Privilege chaining: attacker can immediately invoke high-risk tools without further elevation prompts

  References (4)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • DORA Art. 9(4)(c) Supports evidence

    implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof

    Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers.

  • RTS 2024/1774 Art. 21(a) Supports evidence

    the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access

    Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.

  • ISO/IEC 27001 A.8.2 Supports evidence

    Privileged access rights

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

  • ISO/IEC 27001 A.5.15 Supports evidence

    Access control

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

• Warning The tool uses a scope missing from the inventory

  The mapping gives this tool a scope that no list and no API description here declares. Either the inventory is incomplete, or the name has a typo and the tool will be refused at run time.

  Scopes concerned: records:delete

  ScopeNeat recommendation: Add the scope to the inventory with its owner, or fix its name in the mapping.

  Next step: The steward adds the scope to the dictionary with its owner, or the developer fixes its name in the mapping.

  Accountable Scope steward

  Sources: YogaSec practice

  The strings are defined by the authorization server.

  References (2)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • ISO/IEC 27001 A.5.9 Related

    Inventory of information and other associated assets

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

  • ISO/IEC 27001 A.5.18 Related

    Access rights

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

• Warning High-impact tool, plan a human approval

  This tool can delete, pay, execute or administer, from its annotations or its scopes. A consent given once at sign-in does not cover each of these actions.

  ScopeNeat recommendation: Ask a human to approve each call, with the details of the action, before it runs.

  Next step: The resource owner approves the tool and its human approval mode, with security consulted because the tool changes state.

  Accountable Resource owner

  Sources: Published security guidance

  Use human-in-the-loop control to require a human to approve high-impact actions before they are taken.

  Prompt for user confirmation on sensitive operations

• Note The tool does not describe its behavior

  Without annotations, the MCP defaults apply. The tool is taken as one that can modify, delete, and reach outside systems, so ScopeNeat ranks it as risky.

  ScopeNeat recommendation: Set readOnlyHint, destructiveHint, idempotentHint and openWorldHint to what the tool really does.

  Next step: The developer sets the four annotations to what the tool really does, and the MCP server owner checks them.

  Accountable MCP server owner

  Sources: Defined by the standard

  If true, the tool may perform destructive updates to its environment.