Least Privilege

What is the right permission model for an agent with read-docs, run-SQL, and Slack-send tools?

Why are MCP Tools and Resources distinct primitives rather than one read or write abstraction?

Why does MCP separate Tools and Resources rather than using one unified read/write primitive?

Explain the tool poisoning attack in MCP: mechanism, impact, and defenses

What is tool poisoning in MCP?

What criteria would you use to evaluate the quality of an MCP server's tool definitions before integration?

Which criteria indicate a high-quality MCP server tool definition?

Does MCP sandbox its servers at the protocol level?

Spot the security mistake in this MCP tool output handling

How can a malicious MCP server inject instructions into the LLM via tool output?

Describe three categories from the OWASP MCP Top 10 and what risks they codify

How does the confused deputy problem manifest in MCP with an OAuth misconfiguration?

Why is prompt injection more dangerous in an agent than in a chat only LLM?

Why does agent-generated code require isolation from the host environment?

How does least privilege tool scoping reduce security risk in an agent system?

Which practices reflect the principle of least privilege applied to an agent's tool set?