Cross-Server Tool-Composition Policy

Control objective

Cross-Server Tool-Composition Policy checks how tools from different MCP servers can be chained together within a single agent workflow, blocking dangerous combinations that are individually harmless but together enable abuse — for example one server that can read sensitive customer records chained into another that can send data externally. It matters because tool composition creates emergent privilege-escalation and exfiltration paths (OWASP ASI03 and ASI09, MITRE ATLAS T0085) that no single tool's permissions reveal; in banking this is how a benign read tool plus a benign send tool become a data-leak pipeline. To implement, define an explicit policy describing which cross-server tool chains are allowed and which are forbidden, enforce it at the orchestration layer so that any attempt to compose a forbidden chain is intercepted before execution, and log every cross-server composition, the policy decision and any blocked chain as evidence. There is no numeric metric or formula, so operate against the stated threshold: a cross-server composition policy must be enforced and forbidden cross-server chains must be blocked. Any forbidden chain that executes, or absence of an enforced policy, is a High-priority breach that should halt the workflow, alert reviewers and trigger refinement of the composition rules.