Okta is proposing an identity-based approach to reducing the cost and security exposure associated with AI agents using the Model Context Protocol (MCP).
The company says that limiting the tools available to an AI agent based on its identity can significantly reduce the number of tokens consumed by tool definitions while also narrowing the actions available to compromised identities.
The hidden cost of MCP tools
MCP provides a way for AI agents to connect with external tools and data sources. However, every tool exposed through an MCP server can add information to an AI model’s prompt.
That information can include the tool’s name, description, parameters, and schema. Okta refers to this additional prompt overhead as the “tool tax.”
The cost occurs whenever the agent makes a model call, even if the model ultimately decides not to use most of the available tools. As the number of tools and users increases, the amount of prompt data processed by the model can grow substantially.
Filtering tools before they reach the model
Okta’s proposed solution is to determine which tools an agent is authorized to use before the MCP tool list is included in the model’s prompt.
Administrators can configure individual tools that an identity is permitted to access. Instead of returning an MCP server’s entire catalogue, Okta provides the agent with a narrower set of authorized tools.
The company says the scope is checked again when the agent attempts to execute a tool call. This creates a two-stage control: unauthorized tools are removed from the prompt, while execution is also checked before an action takes place.
This approach follows the principle of least privilege. An AI agent receives only the tools it has been authorized to use rather than becoming aware of an entire collection of enterprise resources.
More than 90% fewer visible tools
Okta tested the approach using internal modelling and found that some permission scenarios reduced the number of tools visible to the AI model by more than 90%.
The company said tool-schema costs declined by roughly the same proportion. However, Okta did not provide absolute token or dollar savings.
The modelling was based on Okta product data and public vendor documentation rather than customer data or a live customer deployment.
Actual savings will depend on factors such as the size of each tool schema, the number of requests, the model being used, model pricing, and the distribution of user permissions.
Modelling different enterprise roles
To estimate the potential impact, Okta modelled an MCP client connected to a catalogue of enterprise tools.
The company mapped individual MCP Server tools to the OAuth scopes required to access them. It then created representative user groups with different permission levels.
These included read-only helpdesk users, helpdesk operators, application administrators, brand and email administrators, and super administrators.
The model compared the full tool catalogue with the smaller catalogue available to each type of user. Okta calculated the reduction based on the proportion of tools removed through identity-based scoping.
Identity controls versus gateway controls
Okta distinguishes its approach from conventional AI gateway controls.
Gateways can monitor and control factors such as token usage, spending, routing, and rate limits. These mechanisms can help organizations manage costs after requests have entered the system.
Identity-based entitlements operate earlier in the process. Instead of simply measuring or limiting consumption, they determine which tools an individual agent or user is allowed to see in the first place.
This means organizations can potentially reduce unnecessary token consumption before the model processes tool schemas.
Security benefits for AI agents
The same mechanism could also reduce the security impact of a compromised AI agent.
If an identity has access to a large number of tools, compromising that identity could potentially expose a broader range of actions. Removing unauthorized tools from the agent’s available toolset narrows that potential attack surface.
Okta’s approach therefore performs access checks both when constructing the tool list and when the agent attempts to execute a tool.
The company argues that this can reduce the blast radius associated with a compromised identity because the agent is exposed only to tools associated with its authorized OAuth scopes.
MCP governance becomes an identity problem
As organizations deploy more AI agents, controlling which tools those agents can access becomes increasingly important.
Okta’s approach treats MCP governance as an extension of identity and access management rather than as a separate cost-management problem.
Organizations considering this model would need to maintain an inventory of MCP tools and understand which permissions or OAuth scopes provide access to each one.
The company says its methodology can then compare the complete tool catalogue with the subset available to different identities and user groups.
The broader idea is straightforward: AI agents should not receive information about tools they are never authorized to use.
By combining identity-based access control with MCP tool scoping, organizations could potentially reduce both the computational cost of AI agents and the number of actions available to them if an identity is compromised.
Source: https://www.artificialintelligence-news.com/news/okta-targets-ai-agent-token-costs-with-mcp-scoping/
