Per-Tool OAuth Scope Binding

Control objective

Per-Tool OAuth Scope Binding checks that the OAuth permissions granted through an MCP server are tightly bound to individual tools rather than shared broadly, so a single tool cannot inherit access far beyond what it needs — preventing an over-privileged tool from reaching banking data or actions outside its purpose. It matters because broad, shared scopes are a classic excessive-agency problem (OWASP ASI06, NIST Human-AI Configuration): if one tool's compromise grants the attacker every scope the server holds, the blast radius is enormous. To implement, map each tool to the minimum OAuth scope it requires, avoid reusing a scope across multiple tools on the same server unless that sharing has been explicitly approved, and run a scope-narrowing proxy that intercepts token use and downscopes requests to only what the invoked tool legitimately needs; log each tool's bound scopes, any approved sharing exceptions and proxy downscoping decisions as evidence. There is no numeric metric or formula, so operate to the stated threshold: no server may share an OAuth scope across more than one tool unless approved, and the scope-narrowing proxy must be live. Any unapproved scope sharing or a missing proxy is a High-priority breach that should trigger least-privilege remediation and review of the affected tokens.