Tool Inventory Matrix
Inventory of MCP servers, tools, permissions, OAuth scopes, credentials, data touched, and allowed actions.
Back to AI Security
MCP and Tool-Permission Review
Check MCP permissions before connecting an LLM to business systems.
A technical review of Model Context Protocol servers, clients, tools, tokens, and approval paths before broad rollout.
Why commission the review
An MCP connection can give an LLM access to files, tickets, databases or deployments. Before enabling it, your team needs to know which actions are permitted and how high-impact actions are controlled.
Best fit: Platform, security, developer experience, and AI infrastructure teams adopting MCP or custom tool-use gateways.
Scope
MCP clients and servers, tool schemas, OAuth and delegated access, credentials, data flows, read/write/delete/send/execute permissions, approval gates, logging, and rate limits.
What you receive
A permission map and a plan to reduce access.
A tool inventory and permission matrix showing what each connection can reach, plus controls for high-impact actions and a prioritized list of access changes.
Timeline
Typically 10 business days from kickoff and access confirmation.
Tool permission classes
Check what each tool can do.
A tool that reads a ticket needs different controls from one that sends a message or deploys code. We group actions by their effect and check the authorization behind each one.
ActionAuthority questionReview focus
READ
Can this identity see it?
Retrieve records, files, messages, or system state.
WRITE
Can this identity change it?
Create or modify records, files, configurations, or tickets.
DELETE
Can this action be recovered?
Remove data or resources where recovery may be limited.
SEND
Can this action leave the system?
Communicate externally through email, messaging, publishing, or transactions.
EXECUTE
Can this action alter operations?
Run commands, deploy changes, approve workflows, or alter operations.
Assessment detail
The proposal identifies the systems and tests included. The report records findings, unavailable access and any checks that could not be completed.
MCP Trust-Boundary Review
Analysis of MCP client/server trust, upstream APIs, token flow, session handling, and local-server exposure.
Destructive-Action Control Plan
Classification of high-impact actions and required approval, policy, sandboxing, or hard-deny controls.
Blast-Radius Map
A map of the data and systems an agent could reach through each tool, including actions it can take.
Scope Reduction Plan
Prioritized changes to permissions, allowlists, user-scoped authorization, outbound access and tool-call logging.
What the review covers
From the MCP client to the system behind the tool.
- Follows tool calls from the LLM client to the system that executes them
- Suitable for internal platforms, customer-facing integrations, and vendor review preparation
- Identifies which permissions the workflow needs and which can be removed
When to use it
Before a new connection goes live.
Use this when LLM clients are being connected to internal systems, SaaS tools, file stores, ticketing systems, databases, or deployment workflows.
Next step