Why Should You Expose Fewer MCP Tools to an Agent (CCA-F D2)?

When a vendor ships an MCP server, the tempting move is to wire every tool it offers into your agent. Weights and Biases shipping an MCP server for experiment data is a recent example (first-hand: MCP servers commonly expose a broad tool set), and the instinct is the same every time: more tools, more autonomy.

The instinct is wrong past a small number of tools. Two costs grow with every tool you expose:

• Context cost. Each tool puts its name, description, and parameter schema into the model's context on every call. The agent pays to read all of them before it does anything useful.
• Security cost. Every tool the agent can call is something a prompt-injected agent can also call. Broad access is broad blast radius.

The better pattern: expose only the tools the current task needs, scoped with least-privilege credentials. Call it the Minimal Tool Surface.

Minimal Tool Surface has two independent dials, and you turn both.

• Surface (which tools the model sees). Route only task-relevant tools into context. A research step does not need the deployment tools; a read step does not need the delete tools. Some teams build a tool-router that selects the relevant subset per task instead of loading the full catalog.
• Privilege (what each tool can do). Back each tool with a scoped, per-user token, never a global service-account key. Then even a tool the agent legitimately holds cannot act outside its lane.

Worked example - "let an agent inspect ML runs, safely."

1. Scope the surface: expose only the read/query tools for this task, not the registry-promote or delete tools.
2. Scope the credential: issue a per-user token limited to that user's projects, not a global key.
3. Isolate execution: if the agent runs shell commands, run them in a sandbox, not on the host.
4. Verify before trust: treat tool output as input to check, not fact, the same judge discipline you apply to any agent step.

That is a Minimal Tool Surface: small menu, narrow keys, isolated execution.

The Confused Deputy - an agent holding broad credentials is tricked (often by prompt injection) into using those credentials for something the attacker could not do directly. The fix is not a smarter agent; it is a smaller key. Least-privilege scoping turns a catastrophic blast radius into a contained one.

This is a long-standing security concept, not a new one (first-hand: the Confused Deputy is a classic capability-security problem), and MCP makes it newly relevant because agents now hold real credentials and act on them.

This is the heart of D2 - Tool Design & MCP Integration, which is 18% of the exam and overlaps tool choice and context management.

The proprietary read: D2 questions reward scoping judgment, not tool count.

• Old instinct: give the agent everything so it can handle anything.
• D2 instinct: give the agent the smallest sufficient tool set, scoped with least-privilege credentials, and route by task.

The distractor pattern to memorize. On D2 scenarios where an agent picks the wrong tool, leaks data, or runs up token cost, the trap answers are "expose more tools," "use a bigger model," or "add more examples." The architecturally correct move is one of:

1. Narrow the surface (route only task-relevant tools), or
2. Scope the credential (per-user, least-privilege), or
3. Isolate execution (sandbox shell/tool calls).

See agentic tool design for the canonical D2 scenario, and tool-call skipping for the failure mode a clean surface helps prevent.

1. Start from the task, not the catalog. List the tools this task actually needs, then expose only those.
2. Default to per-user tokens. Never hand an agent a global key when a scoped one will do.
3. Separate read from write. Keep destructive tools out of read-only tasks entirely.
4. Isolate shell/tool execution. Run untrusted execution in a sandbox, not on the host.
5. Treat tool output as unverified. Check it; do not merge it on faith.
6. Measure the surface. If your agent loads dozens of tools per call, that is a design smell, not a capability.

The meta-skill, and the D2 exam skill, is the same: capability comes from the right tools scoped well, not from the most tools.