Tool lookup_customer

A tool AI agents call, on the MCP server Example Corp assistant.

No approved baseline: nobody approved this tool's scopes.

Says about itself

readOnlyHint: true, openWorldHint: false

Calls

listUsers

Scopes it holds

user:read, crm:write

• Critical A read-only tool holds a scope that can change data

  The tool says it modifies nothing, yet one of its scopes allows writing, deleting or paying. If the agent is misled, the token can do more than the tool needs.

  Scopes concerned: crm:write

  ScopeNeat recommendation: Give the tool only read scopes. If it really needs to write, correct its readOnlyHint annotation.

  Next step: The MCP server owner decides whether the tool really writes, the developer corrects the scopes or the annotation, and the resource owner is consulted on the new mapping.

  Accountable MCP server owner

  Sources: Published security guidance

  Limit the permissions that LLM tools are granted to other systems to the minimum necessary

  If true, the tool does not modify its environment.

  References (2)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • RTS 2024/1774 Art. 21(a) Supports evidence

    the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access

    Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.

  • ISO/IEC 27001 A.8.2 Supports evidence

    Privileged access rights

    Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

• Warning The tool holds a scope none of its calls needs

  The operations this tool calls never require this scope. A token issued for the tool still carries it, so anyone who takes over the tool can use it on other operations.

  Scopes concerned: crm:write

  ScopeNeat recommendation: Remove the scope from the tool's mapping, or add to its calls the operation that really needs it.

  Next step: The developer removes the scope from the tool's mapping, and the resource owner approves the narrower mapping.

  Accountable Resource owner

  Sources: Recommended by the standard (SHOULD)

  The privileges associated with an access token SHOULD be restricted to the minimum required for the particular application or use case.

  References (2)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • DORA Art. 9(4)(c) Supports evidence

    implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof

    Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers.

  • RTS 2024/1774 Art. 21(a) Supports evidence

    the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access

    Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.