AGENTFORCE-MCP-03: Missing Protocol Scope Constraints

🔴 High · Headless MCP Access

Detects MCP server configurations with wildcard scopes, missing scope definitions, or high-privilege tool exposure without namespace isolation. Ensures the principle of least privilege is enforced for all external agent connections.

Details

Field	Value
Rule ID	AGENTFORCE-MCP-03
Severity	High
Category	Headless MCP Access

Remediation

Replace wildcard scope with explicit tool-level scopes. Use --toolsets to restrict access to specific capability groups (e.g., 'data' for read-only, 'metadata' for deployment).

See Also

• Rule catalog index
• Scanning basics
• SARIF output