Skip to content
Go back

Selecting Fewer MCP Tools Is Not the Same as Enforcing Least Privilege

Updated:
Commentary

Originally published onLinkedIn on 11 Dec 2025.

The GitHub MCP Server team’s update on tool-specific configuration and security hardening deserves credit for addressing two operational problems directly: unnecessarily large tool contexts and untrusted repository content. The changelog has no individual byline, so the responsible team and the open-source contributors are the appropriate original creators to acknowledge.

The update introduced fine-grained tool selection, a Lockdown mode for public repositories, and content sanitization intended to reduce prompt-injection risk. These are meaningful controls. They also expose an architectural distinction that is easy to miss: selecting fewer tools is not the same as enforcing least privilege.

Context minimization, data visibility, and authority over effects are three different boundaries.

Tool selection primarily changes the model interface

An MCP server can expose many operations. Loading only the tools needed for a task reduces schema volume, context cost, and the chance that the model chooses an irrelevant operation. It also makes the task interface easier to inspect.

Those are real benefits, but the selected tool name does not completely describe its authority. A repository-reading tool may reveal secrets or private design information. A pull-request tool may combine read and write modes. A workflow tool may trigger code with external effects. Even a narrow tool can accept a broad repository, organization, or ref parameter.

Least privilege requires at least four aligned restrictions:

  1. Tool surface: which operations the model can request.
  2. Resource scope: which repositories, branches, issues, workflows, or organizations those operations can address.
  3. Identity: whose permissions and audit identity the server uses.
  4. Effect policy: which reads and writes may proceed automatically and which require separate approval.

Reducing the first dimension while leaving the others broad improves ergonomics without necessarily reducing the worst-case impact.

Read-only is not a complete safety category

Test-automation agents often need code, issues, pull requests, workflow runs, and failure logs. Much of that access appears read-only. Yet confidentiality and instruction integrity remain at risk.

A malicious issue can attempt to redirect the agent. A workflow log can contain attacker-controlled output. A test fixture can include secrets or personal data. Reading across several private repositories can assemble information that no single result reveals. A read operation can then influence a later write through another connected tool.

This is why content sanitization and Lockdown mode matter. GitHub’s update filters classes of hidden content and can exclude contributions from people without push access in public repositories. But sanitization is a defence, not a proof that the remaining content is trustworthy. Natural-language instructions can be visible and still malicious. A collaborator account can be compromised. Legitimate repository text can be irrelevant to the user’s request but persuasive to a model.

The more durable rule is provenance-aware instruction handling: repository content may provide data and candidate evidence, but it does not gain authority to redefine the user’s goal or the agent’s permission policy.

A bounded architecture for test-automation agents

An agent investigating a failing CI run could be divided into progressively stronger stages:

StageCapabilityDefault effect
Observeread named workflow run, logs, commit, and test artifactsno external mutation
Diagnosecorrelate failures with code and historylocal analysis only
Proposeprepare a patch, comment, or rerun planproduce reviewable candidate
Verifyrun bounded checks in an isolated environmentephemeral compute effects
Actupdate a branch, rerun a job, or comment on a PRexplicit policy or approval

This sequence does not require a human click for every harmless step. It requires the effect class to be visible and the transition into consequential authority to be deliberate. A server-side permission should also remain narrower than the model-visible tool description whenever the platform permits it.

For example, an agent asked to analyse one failing pull request should not inherit organization-wide write access merely because the access token belongs to a maintainer. The task scope should bind the allowed repository, pull request, branch, workflow, and operation set. Any expansion should be a new decision rather than an incidental parameter choice.

Security controls need negative tests

Happy-path tests can show that an MCP integration reads a repository or reruns a workflow. They do not establish that the integration refuses unsafe alternatives. Useful security and reliability tests include:

The expected output is not always an error. It may be a redacted result, a bounded partial answer, an approval request, or a clear statement that the evidence cannot be retrieved under the current authority. Fail-closed behaviour should preserve enough diagnostic information to explain which boundary stopped the operation.

The engineering conclusion

GitHub’s controls make the MCP Server more configurable and safer to operate. Fine-grained tool loading is especially useful for reducing context pressure and accidental tool selection. Lockdown and sanitization address concrete classes of hostile content.

The remaining responsibility belongs to the surrounding agent architecture. Least privilege is established by the intersection of tool choice, resource scope, execution identity, and effect policy. A short list of tools is evidence of a smaller interface. It is not, by itself, evidence of bounded authority.


Share this note

Previous Note
Documentation as Code Still Needs Tests for Documentation
Next Note
A Test Strategy Is Risk Allocation, Not a Geometric Shape