FeedDiscussion
Good framing on the trust boundary shift, because it is the part most MCP write-ups skip. The piece that tends to get underweighted is credentials. Every tool an MCP server can call carries its own auth story, and least-privilege tool scoping stays theater if the process holding those calls also holds an over-broad API key or session token. The real fix is separating the identity that decides, the model, from the identity that acts, the tool credential, and giving each call only the narrowest token it needs. Then rotation stops being a config-file hunt and provenance becomes simpler: when a compromised third-party connector acts, you can see exactly which credential it used and whether that call was expected. That separation is essentially what agent identity layers are starting to formalize, and it is where the supply chain exposure gets easier to contain. Treat credential lifecycle as part of the attack surface, not an ops detail, and the compounding risks you describe get much more tractable.
Good framing on the trust boundary shift, because it is the part most MCP write-ups skip. The piece that tends to get underweighted is credentials. Every tool an MCP server can call carries its own auth story, and least-privilege tool scoping stays theater if the process holding those calls also holds an over-broad API key or session token. The real fix is separating the identity that decides, the model, from the identity that acts, the tool credential, and giving each call only the narrowest token it needs. Then rotation stops being a config-file hunt and provenance becomes simpler: when a compromised third-party connector acts, you can see exactly which credential it used and whether that call was expected. That separation is essentially what agent identity layers are starting to formalize, and it is where the supply chain exposure gets easier to contain. Treat credential lifecycle as part of the attack surface, not an ops detail, and the compounding risks you describe get much more tractable.