Back to guides

Guide · Agents

MCP and Tool Allowlists in Production AI

MCP and function calling are powerful—and dangerous when every tool is enabled. Production agents need an allowlist, argument validation, and server-side authorization.

Open MCP tool sets fail Tool Safety—default deny, validate args, and authorize every call. Primary control: Tool Safety

Default deny, then name what exists

MCP is a transport. It is not a safety model. If you attach "all the example servers," the model can reach filesystem, shell, browser, or payments the moment injection or a bad plan asks. APRF Tool Safety starts with an inventory per agent class—tool name, purpose, impact tier—and registers only that set with the model.

Prompts that say "don't call dangerous tools" are not allowlists. The runtime never offers the tool.

Where tutorials get people hurt

A coding agent got an MCP filesystem rooted at `/`. A README in the repo asked it to read `.env` and paste secrets. The tool was available and unconstrained, so it complied. The fix was narrow: `read_repo_file` under `/workspace` only, path validation, block `.env*`.

Same pattern shows up as free-form args (path traversal, SSRF), one shared MCP host for every agent, and customer-facing bots inheriting internal tool sets.

The mediation layer

model proposes tool call → schema validate → AuthZ (user/workload) → optional HITL → MCP/backend

Validate arguments server-side. Authorize on the end-user or workload identity. Route high-impact tools through Human Approval. Log tool name, args hash, and outcome. Keep prod and sandbox MCP servers separate so a lab misconfig cannot become production reach.

Assess against APRF Core

Run the Core Profile quiz — gated pass/fail blockers for AI production readiness, not a vanity score.

Start Core AssessmentBrowse framework

Related

Frequently asked questions

Is MCP unsafe?
MCP is a transport for tools. Safety depends on which servers you attach, how you validate args, and whether AuthZ and HITL apply—same as any tool API.
Can I allowlist in the system prompt?
No. Allowlists must be enforced by the runtime. Prompts are not controls.
How does this relate to Agent Governance?
Charters define purpose; Tool Safety defines which actions exist. You need both.