How are you securing third-party MCP servers and tools in AI agents?

With Anthropic's Model Context Protocol (MCP) picking up fast, more people are plugging community MCP servers into Claude Desktop and Cursor.

Yesterday while testing a community GitHub MCP server, we noticed something wild:

The user only wanted a tool to read issues (`get_issue`). But during the initialization handshake, the server exposed 14 tools—including `delete_repository` and `push_to_main`.

Because MCP currently has no native OS sandboxing, all 14 tools sat directly in the LLM's prompt window. If an agent processes an untrusted file or issue containing prompt injection, it could be tricked into calling destructive tools.

For makers building agent tools and MCP servers:

1. Are you scoping down your servers into single-purpose tools?

2. How are you handling tool authorization before execution?

Would love to hear how other developers are thinking about agent tool security.