MCP & Tool-Access Review Kit

Least-privilege review for the tools and MCP servers your agents can call: a tool-access matrix, an MCP server intake checklist, an approval-gate policy, and a script that flags risky rows in the matrix.

Doc / CSV / Python script (ZIP + PDF)Least-privilege review for the tools and MCP servers your agents can call: a tool-access matrix, an MCP server intake checklist, an approval-gate policy, and a script that flags risky rows in the matrix.

What's inside

Verify it works

  1. Script runs. python3 check_matrix.py --selftest prints selftest ok (Python 3.9+, no installs).
  2. Sample catches problems. python3 check_matrix.py tool_access_matrix.csv reports ERRORs only on line 6 (the deliberately bad ops-agent,run_shell row: wildcard scope, no approval, personal non-expiring token, no owner) and exits 1. Delete line 6 and it exits 0, with possibly only WARNs.
  3. Your matrix. Replace the sample rows with one row per agent × tool. Re-run until 0 errors. Open the CSV in Excel or Google Sheets if you prefer; keep the header row unchanged.
  4. Policy. Fill every [bracket] in 01_Tool_Access_Policy.md; search for [ to find what's left.
  5. Intake. For each MCP server, complete 02_MCP_Server_Intake_Checklist.md, including section F tests, before connecting agents.
  6. Optional CI. Add python3 check_matrix.py tool_access_matrix.csv to your CI so a bad row blocks the merge.

Preview

First part of the main document, shown as-is:

Agent Tool-Access Policy (template)

Fill the bracketed parts. Keep one copy per agent or per agent platform. Review every quarter and whenever a tool or MCP server is added.

Owner: [name, team] · Agents covered: [list] · Last review: [date]

1. Principles

  1. Deny by default. An agent can call a tool only if it appears in the tool-access matrix (tool_access_matrix.csv) with an owner and a scope.
  2. Narrowest scope that does the job. Read before write; one resource type before many; one tenant before all.
  3. The agent acts as the user, not as a superuser. Credentials are delegated, per-server and short-lived. No shared tokens across MCP servers.
  4. Humans approve what can't be undone. Anything destructive, external-facing or money-moving goes through an approval gate (section 3).
  5. Everything is logged. Every tool call records agent, user, tool, arguments hash, result status and approver (if any).

2. Risk tiers

Tier Examples Default rule
R0 Read, internal search docs, read a ticket Allowed if in matrix
R1 Write, reversible draft an email, create a branch, add a comment Allowed; logged; daily cap
R2 Write, hard to reverse or external send email, merge, post publicly, change permissions Human approval per call
R3 Money, deletion, credentials payments, refunds, delete data, rotate/read secrets Human approval per call + second person for amounts over [$X]; never auto-approved

3. Approval gates

← All kits