From 37770f39d4242654b8b6c46a532cd0a0ce8c8e01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Sat, 29 Aug 2026 18:05:45 +0200 Subject: [PATCH] feat(mcp): cap read volume per caller identity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A scope authorises a read and says nothing about volume. An agent reads a thousand records in seconds where a person clicks ten, and until now nothing noticed: the token is valid, the tool is permitted, the ACL passes. That gap stopped being theoretical the day an autonomous run started reading the whole catalog on a schedule. identifier: credential keys the counter on the sub claim — the end user, whoever is asking on their behalf — so an agent looping under one person's identity spends that person's budget and cannot spend everyone's. Verified on catalog: pm-user and ro-user hold separate counters. Per-route namespace, so a busy domain cannot exhaust another's. Co-Authored-By: Claude Opus 5 --- kong/mcp/rate-limiting.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kong/mcp/rate-limiting.yaml b/kong/mcp/rate-limiting.yaml index e728498..c73b99d 100644 --- a/kong/mcp/rate-limiting.yaml +++ b/kong/mcp/rate-limiting.yaml @@ -18,7 +18,7 @@ plugin: rate-limiting-advanced config: identifier: credential # Per-route counters. Sharing a namespace across domains would let a busy - # catalog exhaust the budget for payments. + # domain exhaust the budget for another. namespace: ${NAME}-catalog-mcp strategy: local sync_rate: -1