# MCP and plugin authority inventory

Rethinking Agents · v0.1 · October 1, 2026

**Review effective access at each execution location.** A signed artifact can legitimately ask for excessive authority. A sandboxed agent may call a host-side tool; record that separate boundary instead of describing it as a sandbox escape.

## Inventory — NOT RUN

Create one row per component and receiver identity. Do not paste credential values.

| Field | Record |
|---|---|
| Component / version / artifact digest / source | UNKNOWN |
| Definition location and whether mutable after approval | UNKNOWN |
| Activation owner / approving owner / expiry | UNKNOWN |
| Execution location: agent sandbox, host, remote service | UNKNOWN |
| Declared operations and resources | UNKNOWN |
| Effective principal and credential reference (name only) | UNKNOWN |
| Verified receiver tenant / objects / actions | UNKNOWN |
| Host mounts, executable config and child-process access | UNKNOWN |
| Egress destinations / secret broker / direct alternatives | UNKNOWN |
| What was independently checked, by whom and when | UNKNOWN |
| Unknown grants and required evidence | UNKNOWN |
| Decision: hold / restricted / approved for named task | hold |

Declared scope is a claim. Inferred reachability is a hypothesis. Verified behavior is evidence of the exercised case, not proof of every grant. Inspect receiver-side authorization where available; an opaque remote credential may leave effective scope UNKNOWN.

## Worked update — fictional, NOT RUN

| Property | Approved fixture v1 | Proposed fixture v2 | Decision |
|---|---|---|---|
| Provenance | Pinned, valid signature | Pinned, valid signature | Provenance passes; continue authority review |
| Tool action | Read issue in demo repository | Read and edit issues | New write grant: hold until explicitly authorized |
| Endpoint | review.example.invalid | admin.example.invalid | Recheck receiver identity and scope |
| Execution | Sandbox-contained process | Host-side executable configuration | New host boundary: hold activation |
| Credential | Read-only demo token reference | Organization-wide PAT reference | Restrict at receiver; no secret values in review |
| Tool definition | Digest pinned | Remote mutable definition | Bind activation to reviewed digest or require re-review |

An unchanged tool name is not an unchanged contract. Diff the executable/configuration, definition, endpoint, grants and dependencies. Revoke or expire superseded access; maintain a rollback path that also restores authority, not only the binary. An emergency exception has an owner, scope and expiry.

## Activation decision — NOT RUN

- Named task and minimum required grant: UNKNOWN
- Authority delta identified: UNKNOWN
- Changed artifact/definition identity: UNKNOWN
- Independent receiver/configuration evidence: UNKNOWN
- Unresolved scope: UNKNOWN
- Approval principal / timestamp / expiry: UNKNOWN
- Test of permitted operation and denied out-of-scope operation: NOT RUN
- Rollback and revocation evidence: NOT RUN
- Final decision: HOLD until the required evidence is established

No automatic scanner is included. This asset supports an actual review even when effective grants cannot be discovered from a manifest. Use the [incident packet](https://rethinkingagents.com/resources/harness-incident-packet.md) when observed behavior contradicts the inventory.