# Why Should You Expose Fewer MCP Tools to an Agent (CCA-F D2)?

> Give an agent only the tools a task needs, not every tool you have. A large tool set burns context on descriptions before any work happens and widens the blast radius if the agent is prompt-injected. For CCA-F D2, the skill is scoping the tool surface and the token, not maximizing it.

**Published:** 2026-05-31  
**Last reviewed:** 2026-05-31  
**Certification:** CCA-F · Claude Certified Architect - Foundations · D2 Tool Design & MCP Integration  
**Tags:** mcp, tool-design, minimal-tool-surface, least-privilege, confused-deputy, cca-f  
**Canonical:** https://claudearchitectcertification.com/blog/minimal-tool-surface-mcp

![Loop the orange ACP mascot as a disciplined toolmaker selecting one tool from a curated wall, with dangerous tools locked in a glass cabinet and a small scoped two-key ring, illustrating the Minimal Tool Surface principle for MCP.](https://claudearchitectcertification.com/blog/minimal-tool-surface-mcp/hero.webp)

> **Quick answer**
>
> Give an agent only the tools the task needs, not every tool you have. A large tool set burns context on tool descriptions before any real work happens, and it widens the blast radius if the agent is prompt-injected. The CCA-F D2 skill is scoping the tool surface, not maximizing it: fewer tools, least-privilege credentials, task-relevant routing.

## What is the Minimal Tool Surface

When a vendor ships an MCP server, the tempting move is to wire every tool it offers into your agent. Weights and Biases shipping an MCP server for experiment data is a recent example (first-hand: MCP servers commonly expose a broad tool set), and the instinct is the same every time: more tools, more autonomy.

The instinct is wrong past a small number of tools. Two costs grow with every tool you expose:

- Context cost. Each tool puts its name, description, and parameter schema into the model's context on every call. The agent pays to read all of them before it does anything useful.
- Security cost. Every tool the agent can call is something a prompt-injected agent can also call. Broad access is broad blast radius.

The better pattern: expose only the tools the current task needs, scoped with least-privilege credentials. Call it the Minimal Tool Surface.

## More tools vs. minimal surface

| Dimension | Expose every tool | Minimal Tool Surface |
| --- | --- | --- |
| Context window | Filled with tool descriptions before work starts | Spent on the task, not the menu |
| Tool-selection accuracy | Drops as the model picks among many lookalikes | Higher: fewer, clearly relevant tools |
| Credentials | One broad/global key | Per-user, least-privilege tokens |
| Blast radius if injected | Everything the key can reach | Only the scoped task |
| Cost per call | Pays to read unused descriptions | Pays for what it uses |
| Right setting | A throwaway demo | Anything real |

## How scoping actually works

Minimal Tool Surface has two independent dials, and you turn both.

- Surface (which tools the model sees). Route only task-relevant tools into context. A research step does not need the deployment tools; a read step does not need the delete tools. Some teams build a tool-router that selects the relevant subset per task instead of loading the full catalog.
- Privilege (what each tool can do). Back each tool with a scoped, per-user token, never a global service-account key. Then even a tool the agent legitimately holds cannot act outside its lane.

Worked example - "let an agent inspect ML runs, safely."

1. Scope the surface: expose only the read/query tools for this task, not the registry-promote or delete tools.
2. Scope the credential: issue a per-user token limited to that user's projects, not a global key.
3. Isolate execution: if the agent runs shell commands, run them in a sandbox, not on the host.
4. Verify before trust: treat tool output as input to check, not fact, the same judge discipline you apply to any agent step.

That is a Minimal Tool Surface: small menu, narrow keys, isolated execution.

## A name for the trap: the Confused Deputy

> The Confused Deputy - an agent holding broad credentials is tricked (often by prompt injection) into using those credentials for something the attacker could not do directly. The fix is not a smarter agent; it is a smaller key. Least-privilege scoping turns a catastrophic blast radius into a contained one.

This is a long-standing security concept, not a new one (first-hand: the Confused Deputy is a classic capability-security problem), and MCP makes it newly relevant because agents now hold real credentials and act on them.

## Why it matters for CCA-F

This is the heart of [D2 - Tool Design & MCP Integration](https://claudearchitectcertification.com/exam-guide), which is 18% of the exam and overlaps [tool choice](https://claudearchitectcertification.com/concepts/tool-choice) and [context management](https://claudearchitectcertification.com/concepts/context-window).

The proprietary read: D2 questions reward scoping judgment, not tool count.

- Old instinct: give the agent everything so it can handle anything.
- D2 instinct: give the agent the smallest sufficient tool set, scoped with least-privilege credentials, and route by task.

The distractor pattern to memorize. On D2 scenarios where an agent picks the wrong tool, leaks data, or runs up token cost, the trap answers are *"expose more tools,"* *"use a bigger model,"* or *"add more examples."* The architecturally correct move is one of:

1. Narrow the surface (route only task-relevant tools), or
2. Scope the credential (per-user, least-privilege), or
3. Isolate execution (sandbox shell/tool calls).

See [agentic tool design](https://claudearchitectcertification.com/scenarios/agentic-tool-design) for the canonical D2 scenario, and [tool-call skipping](https://claudearchitectcertification.com/scenarios/tool-call-skipping) for the failure mode a clean surface helps prevent.

## How to apply it

1. Start from the task, not the catalog. List the tools this task actually needs, then expose only those.
2. Default to per-user tokens. Never hand an agent a global key when a scoped one will do.
3. Separate read from write. Keep destructive tools out of read-only tasks entirely.
4. Isolate shell/tool execution. Run untrusted execution in a sandbox, not on the host.
5. Treat tool output as unverified. Check it; do not merge it on faith.
6. Measure the surface. If your agent loads dozens of tools per call, that is a design smell, not a capability.

The meta-skill, and the D2 exam skill, is the same: capability comes from the right tools scoped well, not from the most tools.

## Related pages

- [MCP - the protocol behind tool exposure](https://claudearchitectcertification.com/concepts/mcp)
- [Tool calling - why descriptions cost tokens](https://claudearchitectcertification.com/concepts/tool-calling)
- [Tool choice - accuracy vs. surface size](https://claudearchitectcertification.com/concepts/tool-choice)
- [Agentic tool design scenario](https://claudearchitectcertification.com/scenarios/agentic-tool-design)
- [CCA-F exam guide (D2 is 18%)](https://claudearchitectcertification.com/exam-guide)

## Frequently asked questions

**Q: What is the Minimal Tool Surface principle?**

Expose to an agent only the tools the current task requires, scoped with least-privilege credentials, instead of wiring up every tool a server offers. It keeps the context window clean and shrinks the security blast radius.

**Q: Why do extra MCP tools cost money even when unused?**

Every exposed tool ships its name, description, and parameter schema into the model's context on each call, so the agent pays for reading them before it does any useful work. A large tool set can consume a meaningful slice of the context window on descriptions alone (🟡 reported across MCP tool-set discussions; the exact token cost depends on the server).

**Q: What is the Confused Deputy problem in MCP?**

A classic security pattern: an agent (the deputy) is tricked, often by prompt injection, into using its broad credentials to do something the attacker could not do directly. With a global API key, a compromised agent can reach data and actions it was never meant to touch. Scoped, per-user tokens shrink that blast radius.

**Q: Does a bigger tool set make an agent more capable?**

Usually the opposite past a point. More tools means more descriptions to read, more chances to pick the wrong tool, and a bigger attack surface. Capability comes from the right tools scoped well, not from raw tool count.

**Q: STDIO or HTTP transport for MCP?**

Use STDIO for local IDE development (lowest latency, process runs on your machine) and HTTP for hosted or production agents (no local process to manage). The transport choice is independent of how many tools you expose, but both pair with least-privilege scoping (🟡 reported as the common practice).

**Q: How does this show up on the CCA-F exam (D2)?**

D2 (Tool Design & MCP Integration) is 18% of the exam. Expect scenarios where an agent misbehaves or runs up cost, and the trap answer is 'add more tools' or 'use a bigger model.' The architecturally correct answer is to narrow the tool surface, scope credentials, or route only task-relevant tools.

## Where this fits on the site

- **MCP** (concepts): Minimal Tool Surface is an MCP design decision: which server tools you expose, scoped how. Start at the MCP primitive. — https://claudearchitectcertification.com/concepts/mcp
- **Tool calling** (concepts): Every exposed tool is a description the model must read and reason over. Tool-calling mechanics explain why more tools means more cost and more confusion. — https://claudearchitectcertification.com/concepts/tool-calling
- **Tool choice** (concepts): When the surface is large, the model's tool-selection accuracy drops. Tool choice is the lever Minimal Tool Surface protects. — https://claudearchitectcertification.com/concepts/tool-choice
- **Agentic tool design** (scenarios): The canonical D2 scenario: designing the tool set an agent sees. Minimal Tool Surface is its core principle. — https://claudearchitectcertification.com/scenarios/agentic-tool-design
- **CCA-F exam guide** (exam-guide): D2 (Tool Design & MCP Integration) is 18% of the exam and rewards scoping decisions over tool count. — https://claudearchitectcertification.com/exam-guide

---

Cite the canonical HTML page: https://claudearchitectcertification.com/blog/minimal-tool-surface-mcp