Why MCP Servers Need Capability Budgets Beyond Basic Authentication

Security checklists for Model Context Protocol (MCP) servers typically focus on authentication, but experts argue that is insufficient without defining what each tool is actually permitted to do during a given run. A capability budget is a short-lived, explicit contract tied to each tool invocation, specifying allowed actions, target resources, call limits, byte quotas, and expiry times. The runtime — not the model — is responsible for validating every request against this budget at multiple layers, including the queue, worker, and tool adapter. A minimal ledger should track each reservation and distinguish between pending and unknown dispatch states to prevent duplicate execution and security gaps. Failure to make reservations durable across worker crashes can turn a single approved call into multiple unintended attempts, making this both a reliability and a security concern.