Best practices for AI agent tools
Short, practical guides on using MCP servers, agent skills and coding agents well and securely. Each one starts from a real incident or a real question, with steps you can copy and a checklist.
- Permissions and access
Confine a terminal-running MCP server to a limited folder and account
You will run DesktopCommanderMCP under a restricted account limited to a single project folder. This reduces the damage a misused terminal tool can do.
AgentArmor team - Permissions and access
Give each swarm agent its own narrowly scoped API key
You will split a shared API key into one key per agent, each limited to the access that agent needs. This reduces risk if one agent is misconfigured or misused, since the sources flag improper scoping as a credential risk in multi-agent swarms.
AgentArmor team - Permissions and access
Give an Argo CD MCP server read-only access by default
You will set up the MCP server so it reads Argo CD application state without the rights to trigger syncs or change deployments. This reduces risk if an agent misbehaves or is manipulated.
AgentArmor team - Permissions and access
Limit Apify tokens to the actors your MCP agent needs
You will review which actors the agent truly needs and keep the MCP server away from your broadest account token. This reduces risk if a token leaks or scraped content steers the agent.
AgentArmor team - Permissions and access
Review a Generated Permission Manifest Before Trusting It
You will check every tool annotation and permission entry in a generated manifest before your client or a directory accepts it. Annotations such as readOnlyHint are hints that clients may ignore, so a wrong one can leave write-capable tools unprotected.
AgentArmor team - Permissions and access
Check that each MCP tool's OAuth scope matches its permission
You will map each MCP tool to the scope it requires and confirm the token carries that scope. This keeps tool calls from failing with insufficient-permission errors and keeps access no broader than intended.
AgentArmor team - Permissions and access
Limit each hosted MCP server to the access it needs
You will scope each MCP server to only the directories and credentials it needs, and check that the paths it reports match what you configured. This reduces risk if a server is compromised or misbehaves.
AgentArmor team - Permissions and access
Give a GitHub MCP token only the repo scopes it needs
You will set up a GitHub token for the MCP server that covers only the organization and repositories the workflow needs. Narrow tokens limit what an agent can reach if the token is misused or leaked.
AgentArmor team - Permissions and access
Limit the Atlassian MCP server to read and search capabilities
You will restrict the hosted Atlassian MCP server so your client sees only read and search tools. This lowers the write surface a coding agent can reach.
AgentArmor team - Permissions and access
Choose read-only MCP tools when your agent only needs research
You will pick MCP servers and tool scopes that only read data, so a research agent cannot change code, files, or accounts. This keeps the blast radius small if the agent misbehaves or a token leaks.
AgentArmor team - Permissions and access
Give each project its own named chrome-devtools-mcp server entry
You will add a separate chrome-devtools-mcp entry for each project so you can change and debug one project's command or Node path without touching the others. The threads do not describe any access scope for these entries, so this is only about keeping setups distinct.
AgentArmor team - Permissions and access
Scope each MCP tool's token before you launch its server
You'll create dedicated least-privilege tokens for each MCP server and wire them into launch config, so a leaked token is limited to what that tool really needs and is not committed to disk.
AgentArmor team - Permissions and access
Create read-only database roles instead of trusting MCP read-only flags
You will give the agent its own database login that can only read the tables it needs, so a flaw in an MCP server cannot change or delete data. The limit lives in the database, not in the tool.
AgentArmor team - Permissions and access
Restrict MCP file-reading tools to an explicit directory allowlist
You will restrict which directories each MCP server can read, so a single exposed or misused server reaches less of your machine. Narrow reach limits the damage when something goes wrong.
AgentArmor team - Permissions and access
Scope MCP database connections to one project and read-only roles
You will narrow the MCP database connection to a single project with a read-only role. This limits what a hijacked assistant session can read or leak.
AgentArmor team - Permissions and access
Pin the filesystem MCP server to 2025.7.1 or later and narrow its allowed directories
You will move the filesystem MCP server to 2025.7.1 or later and shrink the folders it can reach. Both steps reduce risk of it reading or writing outside what you intended.
AgentArmor team - Permissions and access
Require an API key before exposing an MCP HTTP-stream server
You will start your PraisonAI MCP HTTP-stream server only with an explicitly set API key and confirm that unauthenticated requests are rejected. This closes a gap where an unset key left the server open to callers.
AgentArmor team - Permissions and access
Pin mcp-server-git to 2025.12.18 or later and set --repository
You will upgrade mcp-server-git past the fixed release and restrict it to one repository. This closes path and argument issues that let it touch repos outside its intended scope.
AgentArmor team