An MCP Server With Least Privilege on Every Agent Write

Challenge

They wanted Claude working against their production API, and nobody was comfortable giving an agent a token that could do everything the API could do.

Solution

An MCP server in front of it. One typed tool per thing the agent is allowed to do, reads and writes separated, and the write list short enough that somebody signed it off. The server holds the credentials, so the agent never sees a token.

• One tool per action, each with a typed schema. Not a generic call_api tool with a URL parameter, which is the same as having no boundary at all.
• Reads and writes are separate tools. The write list is short and somebody approved it. Anything not on it doesn't exist as far as the agent is concerned.
• The server holds the credentials. The agent never sees a token, so a leaked transcript isn't a leaked key.
• Arguments get validated against the schema before anything reaches the API. A model that invents an order id gets a validation error back, not a deleted order.

Result

The agent does real work, and what it can reach fits in a sentence.

• Every call writes a line: which tool, which arguments, which caller, what came back, how long it took. When somebody asks what the agent did on Tuesday, that's a query and not an argument.
• Writes are rate limited separately from reads, because the failure mode here isn't load. It's a loop.
• The tools and their schemas are documented, so their team can add one without me.
• I still wouldn't point this at anything irreversible without a human in the loop. Least privilege limits the damage. It doesn't remove the need for a confirmation on the things that matter.