MCP-AUTHZ-03 — Least Privilege Tool Design#

# Python example of least privilege tool design

# GOOD: Separated, specific tools
class ConfigReader:
    """Read-only access to configuration files."""

    ALLOWED_PATHS = ['/etc/app/config.json', '/etc/app/settings.yaml']

    def read_config(self, filename: str) -> dict:
        if filename not in self.ALLOWED_PATHS:
            raise PermissionError(f"Not allowed to read {filename}")

        # Can only read, cannot write
        with open(filename, 'r') as f:
            return json.load(f)

class LogWriter:
    """Write-only access to log directory."""

    LOG_DIR = '/var/log/app/'

    def append_log(self, message: str, level: str = 'info'):
        # Can only append to logs, cannot read or delete
        log_file = os.path.join(self.LOG_DIR, f"{date.today()}.log")

        # Validate we're writing to log directory
        if not os.path.abspath(log_file).startswith(self.LOG_DIR):
            raise PermissionError("Path traversal attempt")

        # Append-only mode
        with open(log_file, 'a') as f:
            f.write(f"[{level.upper()}] {datetime.now()}: {message}\n")

class UserLister:
    """Read-only access to user list (no sensitive data)."""

    def list_users(self, filters: dict = None) -> list:
        # Only SELECT, only specific columns
        query = "SELECT id, username, created_at FROM users WHERE active = true"

        # No raw SQL injection possible
        if filters:
            if 'department' in filters:
                query += " AND department = %s"
                params = [filters['department']]
            else:
                params = []

        # Cannot see passwords, tokens, or PII
        with self.get_readonly_connection() as conn:
            cursor = conn.cursor()
            cursor.execute(query, params)
            return cursor.fetchall()

# BAD: Overprivileged combined tool (ANTI-PATTERN)
class FileManager:  # DO NOT USE THIS PATTERN
    """Excessive privileges in single tool."""

    def execute_file_operation(self, operation: str, path: str, content: str = None):
        # Too many capabilities in one tool
        if operation == 'read':
            return open(path).read()  # Can read any file
        elif operation == 'write':
            open(path, 'w').write(content)  # Can write anywhere
        elif operation == 'delete':
            os.remove(path)  # Can delete anything
        elif operation == 'execute':
            subprocess.run(path)  # Can execute anything

// TypeScript example with privilege separation

// GOOD: Minimal, specific interfaces
interface ReadOnlyFileAccess {
    readFile(path: string): Promise<Buffer>;
    listDirectory(path: string): Promise<string[]>;
    // No write, delete, or execute methods
}

interface AppendOnlyLogger {
    appendLog(message: string, level: LogLevel): Promise<void>;
    // No read, update, or delete methods
}

interface QueryOnlyDatabase {
    select<T>(table: string, columns: string[], where?: Conditions): Promise<T[]>;
    // No insert, update, delete, or DDL methods
}

// Implementation with strict validation
class SecureConfigReader implements ReadOnlyFileAccess {
    private readonly allowedPaths = new Set([
        '/app/config/settings.json',
        '/app/config/features.json'
    ]);

    async readFile(path: string): Promise<Buffer> {
        const normalized = path.normalize(path);

        if (!this.allowedPaths.has(normalized)) {
            throw new UnauthorizedError(`Cannot read ${path}`);
        }

        // Read-only file handle
        const handle = await fs.open(normalized, 'r');
        try {
            return await handle.readFile();
        } finally {
            await handle.close();
        }
    }

    async listDirectory(path: string): Promise<string[]> {
        // Can only list config directory
        if (!path.startsWith('/app/config/')) {
            throw new UnauthorizedError(`Cannot list ${path}`);
        }

        return await fs.readdir(path);
    }
}

// GOOD: Separate tools for different privilege levels
class ToolRegistry {
    // Public read operations
    @RequireScope('public:read')
    getPublicInfo(): PublicInfoReader {
        return new PublicInfoReader();
    }

    // Authenticated read operations
    @RequireScope('user:read')
    getUserData(userId: string): UserDataReader {
        return new UserDataReader(userId); // Scoped to single user
    }

    // Write operations require higher privilege
    @RequireScope('user:write')
    getUserUpdater(userId: string): UserUpdater {
        return new UserUpdater(userId); // Can only update, not delete
    }

    // Admin operations clearly separated
    @RequireScope('admin:write')
    @RequireAuditLog
    @RequireMFA
    getAdminTool(): AdminTool {
        return new AdminTool();
    }
}