Securing MCP Servers: Why Tool Permissions Matter More Than Prompts

Abhishek Dhull — Sat, 14 Nov 2026 00:00:41 +0000

While building Sernixa AI, there's one thing I've kept coming back to.

We're making it incredibly easy for AI agents to connect to tools through MCP. But I'm not sure we're paying enough attention to what happens after they're connected.

Say an AI agent has access to your company's email system. It can read emails and send replies.

Now imagine it tries to send a confidential document to an external address.

The agent has valid credentials. The tool works perfectly. But should that action actually be allowed?

That's the problem. Having access to a tool shouldn't mean having permission to do everything with it.

For example, before executing a send_email call, we could check the recipient, attachments, and the user's permissions. Internal reply? Maybe allow it. Sensitive attachment going outside the company? Hold it for approval or block it, depending on the policy.

And importantly, those checks need to happen before the tool executes, not just inside the agent's prompt.

This is the problem I'm exploring with Sernixa AI: connecting what a human authorizes to what an AI agent actually does.

I wrote a more detailed MCP security guide here.

Curious how others are handling this. Are you checking permissions inside the MCP server, or using a separate layer between the agent and its tools?

DEV Community: Abhishek Dhull

Securing MCP Servers: Why Tool Permissions Matter More Than Prompts