Least-Privilege Tool Access
Grant each tool only the rights it truly needs.
Least-Privilege Tool Access is a free MCP Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MCP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Principle
Least privilege means each tool gets only the permissions its job requires, and nothing more. If a tool is tricked, the blast radius stays small. 🔒
Narrow the Scope
A tool that reads one report folder should not be able to touch the whole disk. Give it the smallest scope that still gets the work done, then stop there.
Read vs Write
Split read and write into separate tools when you can. A read-only tool that gets injected can leak data, but it cannot quietly change or delete anything.
Scope Credentials, Not Just Tools
Privilege also lives in the token your server holds. Use a database role or API key scoped to exactly the operations needed, so a slip cannot reach unscoped resources.
A Read-Only Tool
This tool can only look up an order, never modify one. The function body defines the ceiling on what the model can do through it.
@mcp.tool()
def get_order(order_id: int) -> str:
"Read one order by id."
return db.fetch_order(order_id)Avoid the God Tool
One run_anything tool that executes arbitrary code or SQL hands the model total control. Prefer many narrow tools with fixed, predictable behavior instead.
Allowlists Over Blocklists
Decide what is permitted, not what is forbidden. An allowlist of safe operations is far easier to reason about than trying to enumerate every dangerous one.
Constrain the Filesystem
If a tool reads files, pin it to one base directory and reject paths that escape it. A bounded root stops a tool from wandering into system files.
Separate Tools by Sensitivity
Keep low-risk lookups apart from high-risk actions. You can then apply stricter checks and confirmation to only the sensitive tools that truly need them.
Per-User Authorization
The server, not the model, decides who may do what. Check the caller's identity before acting so a tool cannot reach data outside that user's permissions.
Default Deny
Start every new tool from the assumption that it can do nothing, then grant exactly what it needs. A default-deny stance keeps accidental power from creeping in.
Quick Check
Pick the design that best follows least privilege.
Recap
Give each tool the smallest scope, split read from write, scope your credentials, and default to deny. Least privilege keeps any single mistake contained. ✅
Frequently asked questions
Is the “Least-Privilege Tool Access” lesson free?
Yes — the full text of “Least-Privilege Tool Access” is free to read here on the web, and the MCP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MCP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Least-Privilege Tool Access”?
Grant each tool only the rights it truly needs. You practise MCP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MCP Academy?
No prior experience is required. MCP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Least-Privilege Tool Access” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MCP Academy lesson?
Yes. Every MCP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Threats Unique to MCP
- Least-Privilege Tool Access
- Validate & Sanitize Everything
- Guard Destructive Actions