Least privilege is a concept the industry handles well for identity and sloppily for capability. In a typical MCP integration the decision is made by omission: you install the server and all of its tools become available, because switching them off one by one is work and nobody knows which ones the agent will need.
What each extra tool costs
Every exposed tool adds three things, not one:
- One possible action that a poisoned context can invoke.
- One block of text in the context — the description — which is injection surface in its own right.
- One permission the agent's credential must carry, usually for the rest of that service account's life.
The scale is measurable: a large-scale ecosystem analysis identified 370 servers and 1,062 tools providing functionality relevant to chained attack paths. These are not malicious tools — they are legitimate tools whose combination produces capability nobody assessed.
Risk rarely lives in one tool. It lives in the composition of three that together read, transform and send.
A method for cutting
Classify every tool into four categories and treat each differently:
- Internal read — low risk in isolation. Allow.
- Internal write — requires approval when irreversible.
- External read — brings untrusted content into the context. This is the front door for indirect injection.
- External write — an exfiltration channel. This should be the shortest list in your environment.
The dangerous combination is external read plus external write in the same agent. If you need both, split them across separate agents with separate identities — breaking the chain is cheaper than watching it.
The question that cuts half of them
For every enabled tool, ask: how many times was it called in the last thirty days? If the answer is zero, it is doing nothing but widening surface and consuming context.
If you cannot answer that question, the problem is not too many tools — it is the absence of tool-call logging, which is the subject of the next piece.
