Skip to main content
Server or tools have more access permissions than necessary.

​
How to resolve

  • Least privilege principle: Apply the principle of least privilege by identifying the minimum permissions required for each MCP server and tool to function correctly, then restricting access accordingly. Run MCP server processes under dedicated service accounts with limited privileges rather than root or administrator accounts.
  • Access-control: Use operating system-level access controls to restrict file system access to only necessary directories. Implement network segmentation and firewall rules to limit network access to only required endpoints.
  • Dedicated users: For database access, create dedicated database users with minimal grants.
  • Sandboxing: Use sandboxing technologies (containers, virtual machines, process isolation) to further restrict server capabilities.
  • Auditing and monitoring: Document all required permissions and regularly audit actual permissions against documented requirements. Implement runtime monitoring to detect unexpected permission usage.

​
Risk

Governance/Compliance Excessive permissions vulnerabilities violate multiple security standards:
  • NIST Cybersecurity Framework 2.0 (PR.AA-05): Does not enforce access permissions and authorizations consistent with the principle of least privilege.
  • OWASP MCP Top 10 (MCP02:2025 - Privilege Escalation via Scope Creep): Enables privilege escalation through gradual accumulation of excessive tool and resource permissions.
Security Excessive permissions violate the principle of least privilege and dramatically expand the blast radius of security incidents. If an MCP server or tool is compromised through prompt injection, code injection, or other vulnerabilities, the attacker gains access to all resources the server can reach, not just those needed for legitimate operations. This can lead to unauthorized data exfiltration, lateral movement within systems, privilege escalation, destruction of critical resources, and complete system compromise. The risk is amplified in MCP contexts where LLMs may be manipulated to exploit these excessive permissions through adversarial prompts or indirect attacks.

​
Explanation

MCP servers grant LLMs access to potentially sensitive systems and data, making it critical to follow the principle of least privilege. Excessive permissions increase the attack surface and potential damage from exploitation, allowing compromised servers or malicious tools to access resources beyond their operational requirements.

​
Specifications

Trigger
  • MCP server scan detects that the server process or tools have file system, network, database, or API access permissions that exceed the minimum required for their documented functionality.
Severity
  • HIGH
Applies to: MCP Server