Tools & MCP·Advanced·16 min

MCP Capability Boundary Mission

Your Agent can read an order, refund it, update CRM, and export every customer. One broad identity exposes all of it.

CAPABILITY INCIDENT

Discovery is not permission.

You own the Agent gateway in front of an MCP server.

A customer-support Agent needs a small subset of capabilities, but a shared identity can invoke every exposed mutation. The current protocol is stateless request/response; long-running work belongs behind an explicit extension boundary rather than an implicit session.

Objective

Expose only the capabilities, identity scope, and approval path the workload actually needs.

Stakes

A planning error should not become an unrestricted external side effect.

In one sentence

MCP capability discovery does not decide application authority; your runtime still owns authorization, least privilege, side-effect approval, and long-work boundaries.

Loading Mission Engine…

Key takeaways

Discover ≠ authorize

Protocol surface is not application policy.

Least privilege wins

Narrow identity reduces blast radius.

Long work is explicit

Job lifecycle should not be smuggled into session assumptions.

MENTAL MODEL

Capability discovery and authorization are different layers.

A server can announce a capability; only your application should decide whether this Agent may use it.

Current MCP architecture favors explicit capability discovery and stateless request/response. Secure Agent systems add scoped identity, least privilege, auditable side-effect policy, and an explicit boundary for long-running tasks.

✓Never treat discovered capability as inherited permission.
✓Use workload-scoped authority instead of one broad shared identity.
✓Put consequential side effects behind risk-appropriate controls.

LEARNING CONTEXT

Reusable mental model

A server can announce a capability; only your application should decide whether this Agent may use it.

Not seen

CONCEPTS PRACTICED

concept-mcp-boundariesMCP protocol, application state, authorization and capability boundaries
concept-mcp-capability-negotiationMCP discovery, routing and capability interfaces
concept-tool-contractTool contract and schema design
concept-least-privilegeCapability boundary and least privilege

Suggested backfill

No shipped prerequisite is required before entering this incident.

Transfer the model

A server adds a new mutating capability tomorrow. Should your Agent inherit it automatically?

View full learning path

Next: recovery

Now make an Agent survive process loss, replay, and cancellation.

Open Recovery Mission