Argument-level permission rules for MCP tools: tool-name allowlists aren't enough
radim11 · reddit · 2026-10-20
A Reddit practitioner argues that MCP permissions based on tool names alone are insufficient, since the same tool can do very different things depending on its arguments — e.g. letting an agent access GitHub but only certain repos, especially when credentials lack resource scopes.
They shipped argument-level rules for MCP tools, plus JSON body rules for regular API requests, in their open-source CLI, enforcing restrictions on actual arguments and request data. The post asks how others handle this: pre-execution argument validation, in-server permission enforcement, or plain tool-level allowlists.
More from coding & agent
- Acellera runs an unsupervised virtual lab of AI scientists on a real IL-23 molecular discovery program — gdefabritiis · 2026-10-21
- Pydantic author experiments with JS/TS and React support in the Monty sandbox — samuelcolvin · 2026-10-21
- Supabase lets coding agents query your logs to catch errors and slow queries — dshukertjr · 2026-10-21
- $200-tier user says Codex burned 25K credits in days, demands answers from OpenAI — alexcovo_eth · 2026-10-21
- Agent memory debate: save memories whole, build retrieval paths for cold storage — mimi10v3 · 2026-10-21
- tsrs: agent-built Rust port of TypeScript runs 8x faster with 70% less memory — irvinebroque · 2026-10-21