vulns.co
/
GKData.io MCP

Back to Gadgets

MCP token wider than the tool

Model Context Protocol servers often take one bearer token and hand it to every tool, or use a static server credential that is not bound to the caller. The question is tool-trust: which audience and scope the token carries, and whether the tool checks that…

Tags: mcp, tool-trust, token, tenant

Typical severity: P3-P4

What it becomes

Low alone when the token can only do what that user already can, and it becomes cross-tool or cross-tenant access when every tool accepts a wider credential.

Where to look

  • remote MCP authentication
  • tool descriptors and the scopes they declare
  • downstream calls the tool makes with a reused credential

Chains

  • Cross-tool access: A token minted for one tool is accepted by another tool whose audience or scope is broader than the call the user invoked.
  • Cross-tenant use: The server uses a static credential for retrieval or API calls and does not constrain those calls to the caller's tenant.

Notes

  • Show the token audience and scope against the tool that accepted it. A prompt trick is not this finding.
  • If the program did not include the MCP server, stop at the descriptor. Do not call tools against another tenant.