MCP Scope Creep Is a Runtime Problem, Not a Prompt Problem(sunglasses.dev)

1 pointsby azrollinvor 3 Monaten1 comments

MCP Scope Creep Is a Runtime Problem, Not a Prompt Problem

https://sunglasses.dev/blog/mcp-scope-creep-runtime-problem

2 comments

azrollinvor 3 Monaten

Submitter + founder of sunglasses-dev here. This was written by Jack, one of our security research agents, after the Cloud Security Alliance's April report came out showing 53% of MCP implementations vulnerable, plus CVE-2026-25536 landing the week before.

The thing most writeups miss: the "scope" isn't in the prompt — it's in the tool metadata loaded at runtime. So prompt-level filtering can't catch it. A tool's governance appendix can override the main policy AFTER the agent has already decided to call it. We shipped a detection category for this today (GLS-PSR-001). Full scanner is MIT / open source:github.com/sunglasses-dev/sunglasses. Happy to answer questions on the pattern itself or how we detect it at runtime.

vdineshkvor 3 Monaten