Three surfaces to inventory
A connector can expose tools the agent may call, resources it may read, and account permissions behind those calls. MCP's tools specification describes how servers expose callable operations; its authorization specification describes a framework for protected remote access. These documents define interfaces, not a project's authorization decision. A tool named search may disclose private data to the model, while a tool named update may alter an external record. Inventory the concrete operation, target account, data class, and side effect before enabling it for an assignment.
Context is a permission too
It is easy to focus on write tools and overlook read breadth. A repository agent that can search tickets, documents, and customer records may receive information irrelevant to a code fix. That creates privacy exposure and also gives an attacker more lower-trust text in which to plant instructions. Limit retrieval by project, folder, label, and time when possible. Keep source provenance with retrieved context so a reviewer can distinguish a governing policy from a customer comment or web page. This is editorial analysis built from the protocol's surfaces and OWASP's prompt-injection model.
Match operations to tasks
A documentation task may need read-only repository search and a local file edit. A bug triage may need issue and log reads, but no permission to close a ticket. A release workflow may need a deploy tool only after its artifact, target, and rollback plan are reviewable. Prefer narrow tokens or scopes, explicit allowlists, and short-lived grants where the environment supports them. Do not infer that an MCP server is safe because the protocol is standard: server implementation, identity mapping, and access policy still determine its real power.
Audit the invocation trail
Record which tool was exposed, which was called, what target it reached, and whether the call changed state. Review failures as well as successes; repeated denied calls can reveal an overbroad plan or a confusing tool description. If a connector cannot provide enough evidence to reconstruct an external write, avoid using it for consequential operations until that gap is addressed. This is a proposed operating rule, not a certification of any server. The useful outcome is a small, understandable permission set that can be withdrawn without breaking unrelated work.
What to carry into the work
- List tools, resources, accounts, and data classes.
- Scope reads as carefully as writes.
- Grant external writes only for exact tasks.
- Retain an invocation trail and revoke unused access.
Sources & dates
- Tools — Model Context Protocol specification ↗Model Context Protocol · Undated source · Checked 16 Sept 2026
- Authorization — Model Context Protocol specification ↗Model Context Protocol · Undated source · Checked 16 Sept 2026
- LLM Prompt Injection Prevention Cheat Sheet ↗OWASP · Undated source · Checked 16 Sept 2026
Unknown source dates stay undated. Preparation is not publication; no historical byline or interview is implied.