Tools, MCP and least privilege

Real-world analogy

What is it?

A tool has an input schema, an effect and an error contract. MCP standardises context and tool exchange between hosts, clients and servers; your application still owns access decisions. Start with a read-only tool and fixture data.

Real-world relevance

One shared support-ticket product, three optional entry points. Frontend: A design-inspection tool may read components; it must not silently publish a site. Backend: A ticket-read tool enforces tenant ownership using server identity. Mobile: Keep provider credentials off the device; call an authorised backend tool.

Key points

• Describe effects — Name tools precisely: read_ticket is different from send_reply.
• Validate inputs — Reject unexpected fields, oversized text and invalid identifiers at the server.
• Enforce identity — Derive tenant identity from the authenticated session, not a model-supplied argument.
• Minimise credentials — Give a tool only the capability needed for the current task.
• Treat results as data — Tool output can contain malicious text. It cannot grant itself new permissions.
• Handle errors — Return a structured error category without secrets or internal stack traces.
• Keep approval outside the model — A generated approved=true field is not human consent.
• Frontend practice — A design-inspection tool may read components; it must not silently publish a site.
• Backend practice — A ticket-read tool enforces tenant ownership using server identity.
• Mobile practice — Keep provider credentials off the device; call an authorised backend tool.

Code example

import json
def parse_read_args(raw):
    value = json.loads(raw)
    if not isinstance(value, dict) or set(value) != {"ticket_id"}:
        raise ValueError("invalid fields")
    if not isinstance(value["ticket_id"], str) or not value["ticket_id"]:
        raise ValueError("invalid ticket id")
    return value["ticket_id"]

Line-by-line walkthrough

1. 1. Python: JSON parsing and exact fields are only input validation. The actual read handler must separately enforce ticket ownership using authenticated identity.

Spot the bug

read_ticket(ticket_id, tenant_id_from_model)

Explain like I'm 5

Fun fact

Hands-on challenge

More resources

• MCP architecture (Model Context Protocol)
• Download the free offline lab (Python, tests and instructions) (Teamz Lab)