Tool refund_angry_customer

A tool AI agents call, on the MCP server Example Corp assistant.

No approved baseline: nobody approved this tool's scopes.

Says about itself

readOnlyHint: false, destructiveHint: false, openWorldHint: false

Calls

None

Scopes it holds

user:read, crm:write, refund:under_500, payments:transfer, billing:invoices:read

• Warning Too many scopes for one tool

  This tool needs more than four scopes. Asked all at once, they make a consent screen people approve without reading, or refuse. It is often a task tool built on top of several APIs.

  Scopes concerned: user:read, crm:write, refund:under_500, payments:transfer, billing:invoices:read

  ScopeNeat recommendation: Ask first for the read scopes, and the others only when the tool attempts the action that needs them (step-up). Check whether some scopes are near-duplicates.

  Next step: The MCP server owner decides which scopes are asked first and which only at step-up, and the developer changes the mapping.

  Accountable MCP server owner

  Sources: Published security guidance

  Consent abandonment: users decline dialogs listing excessive scopes

  Incremental elevation via targeted WWW-Authenticate scope="..." challenges when privileged operations are first attempted

  References (1)

  A finding supports evidence for these requirements. On its own it does not make an organization compliant.

  • RTS 2024/1774 Art. 21(a) Related

    the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access

    Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.

• Warning High-impact tool, plan a human approval

  This tool can delete, pay, execute or administer, from its annotations or its scopes. A consent given once at sign-in does not cover each of these actions.

  ScopeNeat recommendation: Ask a human to approve each call, with the details of the action, before it runs.

  Next step: The resource owner approves the tool and its human approval mode, with security consulted because the tool changes state.

  Accountable Resource owner

  Sources: Published security guidance

  Use human-in-the-loop control to require a human to approve high-impact actions before they are taken.

  Prompt for user confirmation on sensitive operations