Okta Unleashes MCP Scoping to Conquer AI Token Expenses

Okta has introduced an innovative identity-scoped Model Context Protocol (MCP) tool designed to significantly reduce the "tool tax" incurred by AI agents. This "tool tax" refers to the prompt overhead, specifically tokens consumed by an AI model as it considers a comprehensive list of tools, including those it will ultimately not call. Each model call made by an AI agent typically includes schemas, names, descriptions, and parameters for every tool exposed by an MCP server. This cost is incurred before an agent even attempts a tool call, meaning that a subsequent rejection of an unauthorized request cannot recover the prompt tokens already consumed.

MCP servers serve as a crucial route for connecting AI agents to various tools and data sources, such as Google Workspace, Slack, and internal systems. A single MCP server can expose a vast number of tools, and the model receives a representation of each available tool, including its schema, name, description, and parameters, in its prompt during every turn. Okta highlights that this cost compounds when a widely used MCP server exposes numerous tools, as each active user incurs this prompt overhead whenever their agent makes a model call. This issue escalates with both the number of tools and the number of users, and also has significant access-control implications. An agent aware of tools outside its authorization scope might attempt to use them, leading to token consumption even if the call is rejected at runtime due to lack of authorization.

Okta's proposed solution involves filtering the list of tools before it reaches the model. This is achieved by leveraging permissions assigned to an agent's identity and the associated user. The capability is positioned within Okta’s “blueprint for the secure agentic enterprise,” which advocates for identifying agents, their permitted connections, and authorized actions. Instead of granting access to an entire MCP server, Okta's approach narrows the connection question to individual tools on that server. An administrator configures the specific tools an identity may use within the Okta dashboard. Consequently, Okta returns a scoped tool set, rather than the server’s full catalogue, ensuring the agent receives a shorter, relevant list in its prompt for each turn. Okta further reinforces security by performing a secondary scope check at runtime before any tool call executes, applying least-privilege access at the tool level. This design ensures that an agent is not aware of resources, databases, or tools it has not been expressly authorized to use, directly removing their schema cost from the model call.

Internal modeling conducted by Okta, utilizing Okta product data and public vendor documentation, provided evidence for the claimed reductions. The company modeled a single MCP client with access to a catalogue of enterprise tools, comparing the number of tools visible to the model before and after identity-based scoping. To estimate scoped exposure, Okta mapped MCP Server tools to their corresponding OAuth scopes and defined representative user segments, such as helpdesk read-only users, helpdesk operators, app administrators, and super administrators, weighting each segment by an assumed share of monthly traffic. Okta’s internal findings indicated that some permission scenarios reduced the number of visible tools by over 90%, with tool-schema costs falling by roughly the same proportion. The company noted that tool-schema token cost tracks tool count almost linearly, as each tool contributes its name, description, and parameter schema to every prompt. Actual results may vary based on the tool catalogue, distribution of permissions, model selected, average schema size, request volume, and model pricing.

Okta distinguishes this identity-based scoping from gateway spending controls, which typically cap spending by key, team, or group, and support routing and rate limiting. While gateways can meter tokens and dollars spent to limit costs after a model decision has already become expensive, identity entitlements offer a different, proactive input. Okta emphasizes that per-user and per-agent entitlements determine the specific tools available to an agent or the user behind it, rather than applying access information at a broader group level. Paul Webber, Principal Cybersecurity Industry Analyst at Software Analyst Cyber Research, commented that "Cost control for agents is best provided using identity governance tools that offer more granular control and precision without disrupting business processes," praising Okta’s approach for leveraging existing security entitlement data.

Furthermore, this mechanism directly contributes to security by reducing MCP attack exposure. By removing tools from an unauthorized identity’s view, Okta also removes potential actions that identity could take if compromised. The proposed scope check operates at two points: first, when the tool list is assembled for the agent prompt, and second, when the agent attempts to execute a tool call. This results in a smaller "blast radius" for a compromised identity, as the prompt only contains tools associated with the identity’s authorized OAuth scopes. For organizations assessing MCP access, tool inventory and entitlement mapping are identified as the main operational inputs.