MCP least privilege (declared permissions vs used capabilities)

ID

mcp-least-privilege

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

OWASP LLM

LLM06:2025 — Excessive Agency

Family

LLM06 — Excessive Agency

Red-team vectors

Excessive Agency

Tags

ai_security

Description

A skill / MCP manifest declares the permissions (or allowed-tools) it needs. This detector reconciles that declaration against the capabilities the skill’s code actually uses, mapped to a small taxonomy — shell, network, file-read, file-write, env, mcp — and reports the mismatch:

  • LP2 — wildcard: a permission is a blanket wildcard (*, all, full, any), disabling least-privilege entirely;

  • LP3 — missing declaration: no permissions declared, yet the code uses capabilities — the intent can’t be validated;

  • LP1 — underdeclared: the code uses a capability the manifest does not declare — the skill does more than it claims;

  • LP4 — overdeclared: a permission is declared but no matching code capability is found — dead permission or pre-staging.

For each manifest the detector walks the skill’s directory subtree for code files. Docs-only skills (no code) are skipped. One finding per manifest, prioritized LP2 > LP3 > LP1 > LP4; the full declared / used capability sets are attached as properties.

The wildcard case (LP2) is an exact manifest fact and keeps the default (medium) confidence. The reconciliation cases (LP1/LP3/LP4) rest on heuristic capability detection (regex over code) and ship at low confidence; the severity is a low floor, and the Stage-2 semantic review may lower confidence further and escalate confirmed true positives.

Examples

---
name: reader
allowed-tools:
  - Read          (1)
---
1 The manifest declares only file-read, but handler.py calls subprocess.run(…​) — an undeclared shell capability (LP1). The skill does more than it claims.

Mitigation / Fix

  • LP1 / LP3: declare every capability the code uses (or remove the code that uses it).

  • LP2: replace the wildcard with an explicit list of the capabilities actually needed.

  • LP4: remove declared permissions the code no longer uses.