DE//AGENT
Explore
Tutorial Lesson 4 of 10 · The Agentic Series community intermediate

Audit an MCP server's tool contracts

Before connecting an MCP server, audit its tools for blast radius. Read each tool schema, classify every tool as Read, Write, Destructive, Spend or Exfiltrate, and produce a least-privilege connection config that grants only what the task needs.

At a glance

When Before connecting a new MCP server; Writing the least-privilege config for an agent
Where Agentic Data Engineering
Why Listing a server is not trusting it — a tool schema that can write, delete, spend money or exfiltrate data defines the blast radius before the first call.

Learning objectives

  • Read a tool schema and predict its side effects
  • Classify tools by blast radius
  • Write a least-privilege MCP configuration

What you need

  • The MCP server's tool list and schemas
  • The task the agent must perform
  • [object Object]

Steps

  1. Read a tool schema and predict its side effects. (from skill-mcp-tool-contract-auditor )
  2. Classify every tool — Read, Write, Destructive, Spend, Exfiltrate. (from skill-mcp-tool-contract-auditor )
  3. Treat Destructive tools (delete/drop/truncate) as requiring human confirmation. (from skill-mcp-tool-contract-auditor )
  4. Produce a table of tools by class, then a config that grants only the Read/Write tools the task needs. (from skill-mcp-tool-contract-auditor )
  5. Never connect an unvetted server with broad credentials. (from skill-mcp-tool-contract-auditor )

Check yourself

  • Every tool in the server's list lands in exactly one class — Read, Write, Destructive, Spend or Exfiltrate.
  • The connection config grants only the Read/Write tools the task needs, and Destructive tools require human confirmation.

Worked example

Install the auditor skill — from skill-mcp-tool-contract-auditor 

npx de-agent-platform add mcp-tool-contract-auditor

Classify every tool by blast radius — from skill-mcp-tool-contract-auditor 

- Read — safe, still logs the data it can reach.
- Write — can mutate state; needs a sandbox or a dry-run.
- Destructive — delete/drop/truncate; require human confirmation.
- Spend — provisions resources or runs billable queries.
- Exfiltrate — can send data to an external network.

The deliverable — from skill-mcp-tool-contract-auditor 

A table of tools by class, then a config that grants only the Read/Write tools
the task needs. Never connect an unvetted server with broad credentials.

Sourced from

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

  • Read tools are safe, but still log the data they can reach.
  • Spend tools provision resources or run billable queries — classify them even when they read like lookups.
  • Never connect an unvetted server with broad credentials.

Production considerations

  • Keep the tools-by-class table with the config so reviewers can see the blast radius.
  • Produce the least-privilege connection recommendation as the deliverable, not just the classification table.

Diagram

mcp server
   |
   |- list tools --> read each schema --> predict side effects
   |
   |- classify --> Read / Write / Destructive / Spend / Exfiltrate
   |
   |- deliverable --> tools-by-class table --> least-privilege config
   |
   |- unvetted + broad credentials --> never connect

Registry stats

Verification community · Oct 21, 2026
Completeness 81
Trust multiplier ×1.25
Composite 34.15 · adequate
Freshness 3 days since last source check
Difficulty intermediate
Version 0.1.0
License CC-BY-4.0
Security flags none