MCP and agent tools
The model is not the boundary. Inventory every tool the agent can call, the credentials that tool uses, and what a document you own can convince it to pass along.
Tags: mcp, agent, llm, authz
Checklist
- Tool inventory: Names, arguments, and side effects: read, write, send, browse, or shell. Include tools the chat UI never shows.
- Tool identity: Does the call run as the user, as the app, or as a shared service account? A successful call should show which identity was used.
- Argument authorization: Object ids and URLs the tool accepts. Replay an id from account A with account B's agent, only for objects both accounts own in the test.
- Untrusted text: Documents, tickets, pages, and earlier tool results the agent will read. Note where that text becomes a tool argument.
- Human approval: Which tools require a confirm, and whether a second tool or a retry can skip that confirm. Record the gate you actually saw.
- Where output goes: Chat, email, webhook, or logs. A marker you placed in your own document is enough to see the channel.
- Memory across users: Files, memory, and retrieved chunks from user A should not answer user B. Use a marker, not someone else's data.
- Stay in scope: Do not ask the agent for other tenants, credentials, or hidden instructions you are not authorized to read.