mcp tool permission scoper

Most Model Context Protocol (MCP) deployments rely on human guesswork for tool permissions. Developers often grant broad scopes like `admin:*` to simple bots, creating massive security holes, or spend hours manually auditing logs to justify trimming access. This skill replaces guesswork with usage evidence. It analyzes your agent's `tools/call` history over a specific window to generate a least-privilege allowlist based on what the agent actually does, not what a human thinks it might do. ## What it does - **Log Attribution Validation** verifies that tool calls are tied to specific, authenticated identities before generating role-based scopes. - **Usage Analysis** pulls historical tool call data over a 90-day window to identify every server and tool interaction. - **Grant Diffing** compares observed tool usage against current permissions to highlight gaps, shadow access, or unused grants. - **Least-Privilege Scoping** generates an allowlist artifact that matches only the tools the agent successfully used. - **Disambiguation Mapping** keys permissions to `server_id:tool_name` to prevent scope leakage in multi-server environments. ## How it works 1. **Source Logs** are provided to the agent, covering a bounded observation window of historical tool activity. 2. **The Diagnostic Report** identifies tools that were called but not granted, and tools granted but never used. 3. **The Config Generator** produces a platform-specific RBAC artifact, such as Bifrost JSON or agentgateway CEL rules. 4. **The Review Cycle** presents the output as a diff for human approval, flagging rare break-glass tools for manual retention. ## Frameworks & tools Works with any MCP gateway or RBAC layer including Bifrost, agentgateway, Obot, and MCPManager. It targets the standard MCP `tools/list` and `tools/call` protocol specifications. ## Why this beats prompting it yourself Generic prompts often treat "never called" as "delete immediately," which breaks critical but rare incident-response tools. This skill follows the AWS IAM Access Analyzer precedent, using a formal request-review-refine loop and independent classification to protect rare-use paths while eliminating routine scope creep. ## Use cases - Generating a defensible starting allowlist when standing up a new MCP gateway. - Trimming broad grants from reporting bots that only need read access to three tools. - Automating periodic access-recertification cycles for internal agent fleets. - Justifying permission reductions with concrete usage evidence for security audits. ## Known limitations Cannot enforce policies; it only generates the configuration for a gateway to enforce. It is limited by the granularity of the target gateway and the attribution quality of the provided logs.