Implementing Per-Call Authorization in MCP
ani_0523 · reddit · 2026-07-13
The author discusses the practical challenge of how to authorize every tool call after an MCP connection is established:
- MCP authentication alone only proves the client can connect to the server; by default, every tool can be invoked once connected.
- If a prompt injection occurs during an agent session, the model might directly invoke high-risk tools (like deleterepo).
- Their solution involves placing a lightweight proxy layer before the stdio path:
- Checking for grants before every tools/call.
- Allowing authorization to be revoked mid-agent run, causing the next call to fail immediately.
- Filtering tools/list so the model can't see unauthorized tools.
- Keeping secrets outside the agent process as much as possible.
They also open-sourced their implementation (Go, Apache-2.0) and asked the community whether they handle per-call authorization at the MCP layer or internally within the tool server.
Related event: Challenges of Tool-Level and Call-Level Authorization in Agent CLIs(2 posts)→
More from coding & agent
- Dev builds talk on guardrails workflow for shipping AI-written code without reading it — TejasKumar_ · 2026-09-11
- banteg: Codex auto-review has regressed, blocking steps needed to complete authorized tasks — banteg · 2026-09-11
- lucasmeijer's workflow: handwrite the doc yourself, then have the agent challenge your understanding — lucasmeijer · 2026-09-11
- A doc-anchored agent workflow: you write, the agent only critiques and finds disagreements — lucasmeijer · 2026-09-11
- SymKit MCP: 44 tools for AI agents to verify symbolic derivations — Foreign-Specific-604 · 2026-09-11
- GitHub Copilot team routes user bug reports to an AI agent via Slack — marlene_zw · 2026-09-11