The Wildcard Scope Problem: Why MCP Configs Default to admin:* Instead of Least Privilege

Recent reports have highlighted a concerning issue in many MCP (Managed Configuration Protocol) configurations: the default use of wildcard scopes, such as "admin:*" or "full_access", rather than the more secure practice of explicitly defining permitted actions. This default behavior stems from a common practice among developers and administrators: when a server's README suggests granting a certain scope for functionality, and the exact scope isn't clearly documented, the wildcard is simply copied and pasted as a quick fix.

During a review of the config heuristics in sentinel-scan-cli, a tool used for static security checks, it was discovered that the check for wildcard scopes is one of the simpler but also highly effective rules. This rule specifically flags MCP configurations that use wildcards or unbounded blanket terms for permissions instead of enumerating the exact permissions required.

The rule aims to identify scenarios where a tool or server entry declares a scope that is too broad. For example, instead of specifying explicit permissions like "contacts:read" and "notes:write", a configuration might use a wildcard like "admin:*". While both configurations might grant the same effective access to a tool, the second option clearly defines what parts of the system the tool is permitted to access.

In contrast, the wildcard approach offers no clarity until the server's source code is examined or a problem arises.

This approach, while often faster to implement, poses significant security risks. Even though it's a static manifest check and cannot determine the actual API-level permissions granted by a wildcard scope, it does catch the more prevalent issue of scope not being explicitly defined at all. This is problematic because, months later, adding a new MCP server to an existing agent session could create security vulnerabilities if the new server defaults to a wildcard scope.

Reviewing and comparing the permissions of various tools becomes much more difficult when one tool uses a wildcard and another uses a specific, limited set of permissions.

The fix for this issue is straightforward: instead of using wildcards, administrators should enumerate the exact permissions required for each tool. This practice takes about five minutes to review the server's tool list and map out the exact permissions needed. The benefits of this practice are significant, particularly when it comes to auditing scope creep. If no specific permissions were documented initially, retroactively auditing permissions becomes nearly impossible.

Most MCP servers that support scoped permissions also support enumerated scopes, but the wildcard is often the first example provided in the README due to its simplicity. Enumerating permissions requires an extra five minutes of work to map which tools will be used and what permissions are necessary, but it pays off immediately when someone else has to review the configuration without delving into the server's source code.

The tool sentinel-scan-cli can perform this static scan, checking for a range of issues including plaintext remote transports, hardcoded credentials, and missing provenance metadata, all without making any network calls or executing the server. This can be mapped against the OWASP MCP Top 10 categories for a comprehensive report.

The question remains: what is the actual scope granularity like in your production configurations, are they by default set to wildcards or are they set to enumerate permissions from the outset?