MCP Server Least Privilege: Read-Only Mode and Toolsets

• Treating disable_destructive as read-only

  It hides only tools flagged destructiveHint. On v0.0.67 it left helm_install and pods_run, which can install any chart or run any image the credential allows. Use read_only, or disable those two by name.

• A typo that fails open

  readonly instead of read_only loaded silently on v0.0.67 and exposed 20 tools. Newer versions reject unknown keys instead. Either way, audit tools/list after every config change and every upgrade.

• One credential for reading and writing

  If the agent's server holds the same token you deploy with, the filters are all that stand between a prompt and a delete. Mint a separate read-only identity with a short-lived token, and keep write access out of the agent's reach.

• An allow rule wider than the job

  An allow rule such as mcp__kubernetes__* pre-approves every tool that server offers, including write tools a later version adds. Allow named read tools, and deny the write tools explicitly.

1. 1

   Make a practice folder that holds nothing you care about. It is the only place the server will be allowed to touch.

   mkdir -p ~/mcp-practice && echo hello > ~/mcp-practice/note.txt

   Copy
2. 2

   List the server's tools and sort them by their readOnlyHint annotation. Note the write tools: write_file, edit_file, move_file and create_directory.

   npx -y @modelcontextprotocol/inspector --cli npx @modelcontextprotocol/server-filesystem ~/mcp-practice --method tools/list

   Copy
3. 3

   Ask for a file outside the allowed folder. The server should refuse with an error, because /etc is outside its allowed directories.

   npx -y @modelcontextprotocol/inspector --cli npx @modelcontextprotocol/server-filesystem ~/mcp-practice --method tools/call --tool-name read_text_file --tool-arg path=/etc/hosts

   Copy
4. 4

   Register the server in Claude Code for this project, then deny the four write tools in .claude/settings.json.

   claude mcp add fs -- npx -y @modelcontextprotocol/server-filesystem ~/mcp-practice
   
   {
     "permissions": {
       "deny": [
         "mcp__fs__write_file",
         "mcp__fs__edit_file",
         "mcp__fs__move_file",
         "mcp__fs__create_directory"
       ]
     }
   }

   Copy
5. 5

   Start Claude Code and ask which fs tools it can call. The four denied tools should be missing, because a deny rule removes a tool from the model's context.

   claude "List every tool you can call from the fs MCP server."

   Copy

From: 1. What Is an MCP Server? How One Tool Call Travels

1. 1.Why keep a separate write credential instead of one token plus a read-only server setting?Show the answer

   Answer:A setting inside the server is only as correct as its config and its tool labels. A credential that cannot write is enforced by the system itself, so a typo, an upgrade or a mislabelled tool cannot turn into a delete.

2. 2.A server upgrade adds a new write tool. Which layers catch it, and which let it through?Show the answer

   Answer:The read-only credential still refuses what the tool tries, and a tools/list audit in CI flags the new name. A broad allow rule such as mcp__server__* pre-approves it silently, which is why named allow rules and explicit deny rules age better.

3. 3.Why set denied_resources for Secret when the view role already cannot read Secrets?Show the answer

   Answer:It fails safe when the credential drifts. If someone later binds a broader role to the agent's identity, the server still refuses that kind.

• Kubernetes MCP server: read_only, toolsets and denied resources
• an MCP server security checklist
• AI agent least privilege for credentials and tokens
• MCP write controls: WriteGuard vs approval prompts