Securing AI Agent Tool Access with the Model Context Protocol

The Model Context Protocol (MCP) is an open protocol that lets AI agents discover and call tools. Most examples assume the agent and the tool server share an owner. In practice, teams now run coding agents they did not write against tools they do own, so the MCP server is where scope has to be enforced.

This talk walks through an architecture for an MCP server that fronts sensitive tools, using only the open specification:

• One endpoint and one short-lived credential per agent session, revoked when the session ends

• tools/list as discovery only; every tools/call checked again against the session, the tool catalog and the call's arguments

• Calls that wait for a human approval without breaking the protocol, and why a lost response is an unknown outcome rather than a success

Failure cases worth testing in any MCP server: renamed tools, out-of-scope file paths, calls replayed after revocation, and calls aimed at another session.

The honest boundary: what a protocol-level gateway cannot stop on its own (shell access, direct APIs, credentials held elsewhere), and where a sandbox has to take over.

The walkthrough uses plain JSON-RPC messages from the MCP specification, so attendees can apply it to any open-source MCP SDK or server.

The patterns come from building an agent runtime at Skyflo. That runtime is proprietary; the talk teaches the open-protocol design and contains no product pitch.

A call lifecycle for MCP servers that front sensitive tools, from session credential to recorded outcome

A checklist of refusal cases to test before exposing internal tools to an agent

A clear line between what the protocol layer can enforce and what belongs to the sandbox