Topic starter
24/06/2026 8:06 pm
TL;DR: MCP servers commonly expose every tool by default, which creates both over-permissioned AI agents and context rot that degrades tool selection accuracy, according to Kong. The governance lesson is that production MCP needs default-deny tool filtering, identity-based routing, and credential isolation, not just prompt-injection defenses.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# Model Context Protocol (MCP) Security: How to Restrict Tool Access Using AI Gateways”.
Key questions
Q: How should security teams restrict MCP tools for production agents?
A: Security teams should place a policy enforcement layer between the agent and the MCP server, then assign each agent persona a minimal allow list.
Q: Why does exposing too many MCP tools create security and reliability risk?
A: Excess tool exposure expands the number of capabilities an agent can potentially use and increases the chance of incorrect tool selection.
Q: What are the signs that MCP governance is failing?
A: Common signs include agents reaching systems outside their intended workflow, incomplete audit trails for tool use, and data retrieval that cannot be tied back to a clear business purpose.
Practitioner guidance
- Define persona-scoped tool catalogs Map each agent persona to a minimal tool set and block every unlisted capability at the gateway.
- Separate identity validation from tool discovery Require a validated identity token before any MCP endpoint can enumerate tools, then apply consumer-group mapping to decide what that identity can see.
- Isolate backend credentials from agent identities Inject backend tokens at the gateway or pass them only where necessary, so the agent never handles long-lived provider secrets directly.
Bottom line: MCP tool exposure turns a convenience feature into an entitlement problem when agents can discover every capability by default.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:16 am
Tool visibility is becoming the control plane for MCP security: When every tool is exposed by default, the governance problem is no longer prompt safety alone. Identity teams have to decide which agent personas are entitled to see which capabilities, because visibility itself creates risk. The practical conclusion is that MCP must be governed like any other entitlement surface, not treated as a neutral transport layer.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do identity-based routing and tool ACLs work together in MCP governance?
A: Identity-based routing decides which requester is asking, and tool ACLs decide which capabilities that requester can see or use. Used together, they let teams keep one backend MCP server while presenting different tool views to different agent personas.
👉 Read our full editorial: MCP tool access control is becoming the new AI gateway priority