Check the caller's rights on every handle

How to do it

Without sessions, a basket, a draft or a browser context lives behind a handle that the model carries from call to call. A model can be tricked into passing another user's handle, and handles leak into logs and transcripts. Store the owner with each handle, and compare it with the token's user and grant on each call. Make handles random and opaque, at least 128 bits, so nobody can guess them. Give each one an end time, and state it in the creating tool's description. Answer an unknown, expired or foreign handle with the same tool error, so nobody learns which handles exist. This is Check ownership on every record applied to handles.

Examples

JavaScript example

export async function basketFor(handle, token) {
  const basket = await baskets.find(handle);
  if (!basket || basket.ownerId !== token.sub || basket.expiresAt < Date.now()) {
    return { isError: true, content: [{ type: 'text', text: 'Unknown or expired basket. Call create_basket for a new one.' }] };
  }
  return basket;
}

Python example

def basket_for(handle: str, token: dict):
    basket = baskets.find(handle)
    if basket is None or basket.owner_id != token["sub"] or basket.expires_at < datetime.now(UTC):
        return {"isError": True,
                "content": [{"type": "text", "text": "Unknown or expired basket. Call create_basket for a new one."}]}
    return basket

How to check

User A creates a basket. A call by user B with A's basket_id returns the same isError result as a made-up handle, and A's basket is unchanged.

Sources

• MCP specification on tools (stateful tools)

Related rules

• AGT-11 Build the MCP server without sessions in Agents as users
• SEC-17 Check ownership on every record in Adversarial testing
• AGT-19 Run long work as tasks in Agents as users