{
  "id": 19939146,
  "title": "An MCP Tool Schema Is Not an Authorization Check: A Laravel Design Pattern",
  "url": "https://urgent.news/2026/11/14/an-mcp-tool-schema-is-not-an-authorization-check-a-laravel-design",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-14T07:23:11.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/larwelltechnologies/an-mcp-tool-schema-is-not-an-authorization-check-a-laravel-design-pattern-12ma"
  },
  "original_language": "en",
  "account": "The MCP tool schema alone does not provide authorization checks. While it aids in constructing a call by specifying input parameters like an invoice ID and reason, it does not determine who is permitted to perform the action, such as refunding a particular invoice. The responsibility lies with the server to handle input validation, access controls, rate limiting, and output sanitization. Additionally, the specification recommends confirming sensitive operations within the chat interface, but this confirmation should not replace server-side enforcement. A layered security approach is advised, involving authentication and throttling at the HTTP level, followed by server-side validation of the arguments. After validating the invoice details, the server must authorize the action on the specific record by consulting policies. Laravel's gates and policies are designed for such decisions. The flow includes steps like authenticating the caller, validating the input, loading the invoice in the appropriate tenant scope, authorizing the refund action, checking for idempotency and current state, executing one mutation, and recording relevant details. Tools should be designed with a read-only preview_refund endpoint, followed by a commit_refund endpoint that rechecks authorization and state. The response should contain only necessary information for the assistant, like the operation ID, status, and a safe summary. Avoid leaking sensitive data or implementation details. Before exposing a write tool, ensure no unauthenticated caller can reach the endpoint, all arguments are validated on the server, a policy checks the actor against the specific record, retries are safe and observable, and the output does not reveal sensitive data.",
  "summary": "An MCP tool can be wonderfully easy to call. That is exactly why a write-capable tool deserves more scrutiny than a read-only one. Imagine an assistant with a refund_invoice tool. Its input schema says it accepts an invoice ID and a reason. The schema helps a client construct a call; it does not tell your server which person is allowed to refund which invoice . Those are separate decisions. The…",
  "key_points": [
    "MCP tool schema alone does not handle authorization",
    "Server handles input validation, access controls",
    "Laravel gates and policies used for authorization decisions"
  ],
  "editors_take": "Relying solely on tool schemas for security creates vulnerabilities that necessitate a layered defense where server-side policies and authentication act as the ultimate gatekeepers for sensitive operations.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}