Split actions by their effect
Status and session reading can use separate permissions from execution. Sending input or stopping a process changes a live session. Administrative commands need an additional authorization decision.
The server validates the target and scope for each call. A tool description or model instruction does not replace that validation.
Test the authorization lifecycle
The MCP HTTP authorization model describes resource discovery, token use and scope challenges. Test expiry, wrong resource tokens, revoked access and a client requesting a capability it has not been granted.
Treat returned text as evidence
A command result needs its exit state, output and errors. A long session needs a cursor and completion state. Truncated output should be identified with a route to read what remains.
Logs and files may contain instructions written by another person. Their contents remain separate from authority to execute work. Tests should include misleading text and requests beyond the permitted target.
Before you begin
Should every tool receive administrator access?
No. Assign the permission needed for the task and review operations that genuinely require elevation.
Can approval apply to one operation?
A custom workflow can bind approval to a target and action. Its expiry, reuse and cancellation rules need testing.
DSDillon / 26 September 2026
