Tool export_monthly_report

A tool AI agents call, on the MCP server Example Corp assistant.

No approved baseline: nobody approved this tool's scopes.

Says about itself

readOnlyHint: true, openWorldHint: false

Calls

None

Scopes it holds

reports, files:*

• Critical A read-only tool holds a scope that can change data

  The tool says it modifies nothing, yet one of its scopes allows writing, deleting or paying. If the agent is misled, the token can do more than the tool needs.

  Scopes concerned: files:*

  ScopeNeat recommendation: Give the tool only read scopes. If it really needs to write, correct its readOnlyHint annotation.

  Next step: The MCP server owner decides whether the tool really writes, the developer corrects the scopes or the annotation, and the resource owner is consulted on the new mapping.

  Accountable MCP server owner

  Sources: Published security guidance

  Limit the permissions that LLM tools are granted to other systems to the minimum necessary

  If true, the tool does not modify its environment.

  References (2)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • RTS 2024/1774 Art. 21(a) Supports evidence

    the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access

    Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.

  • ISO/IEC 27001 A.8.2 Supports evidence

    Privileged access rights

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

• Critical The tool relies on a scope that grants everything

  The token behind this tool opens every operation of the system, not only what the tool does. An agent turned against its user can reach all of it without any new consent.

  Scopes concerned: files:*

  ScopeNeat recommendation: Map the tool to the narrow scopes its calls need, and request the others only when a riskier action is attempted.

  Next step: The developer maps the tool to the narrow scopes its calls need, and the resource owner approves the new mapping with security consulted.

  Accountable Resource owner

  Sources: Published security guidance

  Privilege chaining: attacker can immediately invoke high-risk tools without further elevation prompts

  References (4)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • DORA Art. 9(4)(c) Supports evidence

    implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof

    Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers.

  • RTS 2024/1774 Art. 21(a) Supports evidence

    the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access

    Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.

  • ISO/IEC 27001 A.8.2 Supports evidence

    Privileged access rights

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

  • ISO/IEC 27001 A.5.15 Supports evidence

    Access control

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

• Warning High-impact tool, plan a human approval

  This tool can delete, pay, execute or administer, from its annotations or its scopes. A consent given once at sign-in does not cover each of these actions.

  ScopeNeat recommendation: Ask a human to approve each call, with the details of the action, before it runs.

  Next step: The resource owner approves the tool and its human approval mode, with security consulted because the tool changes state.

  Accountable Resource owner

  Sources: Published security guidance

  Use human-in-the-loop control to require a human to approve high-impact actions before they are taken.

  Prompt for user confirmation on sensitive operations

• Warning Reading sensitive data is not low risk

  You marked this tool as reaching sensitive data. Even read-only, it can send that data into the conversation, and from there anywhere the agent can write.

  ScopeNeat recommendation: Narrow its scopes to the data the task needs, show the user what it will read, and log each call.

  Next step: The resource owner decides what the tool may read, with the DPO consulted when personal data is reached.

  Accountable Resource owner

  Sources: Published security guidance

  Show tool inputs to the user before calling the server, to avoid malicious or accidental data exfiltration

  References (2)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • GDPR Art. 25(2) Supports evidence

    The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.

    Applies as: legal requirement. Applies whenever personal data is processed, so only to scopes that reach personal data.

  • ISO/IEC 27001 A.8.3 Supports evidence

    Information access restriction

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.