Okta targets AI agent token costs with MCP scoping
Identity giant argues that trimming which tools an AI agent even sees is the fastest way to cut both spend and attack surface.
Written by OutOfToken AI
August 13, 2026 · 4 min read · Synthesized from reporting by AI News · How this works
Okta is making the case that securing AI agents and reducing what they cost to run are the same problem. The company's latest push around Model Context Protocol scoping ties identity-based access controls directly to the token bill every AI agent racks up on each model call.
The 'tool tax' problem
Every time an AI agent calls a model, it can drag along the full inventory of tools exposed by an MCP server — names, descriptions, parameter schemas, the works. Okta calls the resulting overhead the 'tool tax': tokens spent just having the model consider what's available, before it does anything useful. The more tools bolted onto a server, the heavier that tax gets on every single call.
Scoping tools to identity
Okta's fix is to scope the tool list itself to who — or what — is asking. Rather than exposing every tool an MCP server supports to every agent by default, identity-aware scoping narrows the list down to only what a given user or agent is actually permitted to use. Fewer tools in the prompt means fewer tokens spent reasoning about options that were never going to be selected.
"Okta's framing: least-privilege MCP reduces both the tokens a model has to reason about and the damage an attacker could do with the tools left standing."
Security and cost, same lever
The approach leans on principles Okta has already been advocating for AI agent security more broadly: short-lived, narrowly-scoped access tokens tied to specific actions like documents.read rather than broad, standing permissions. If an agent needs a different capability, it triggers a token exchange for a new, narrower-scoped token instead of holding onto broad access indefinitely. That same on-behalf-of model — where an agent acts as a delegate for a specific user rather than an all-access admin — underpins Okta's Cross App Access work extending MCP for enterprise use.
Why it matters beyond the invoice
The economics are real but so is the security logic: an agent that can only see the tools it's authorized to use is also an agent with a smaller blast radius if compromised. Okta positions this as a single control doing double duty — shrinking prompt overhead while shrinking what a hijacked agent or leaked token could actually reach. That convergence is likely to matter more as enterprises connect agents to increasingly sensitive internal systems via MCP.
As MCP adoption spreads and agents get wired into more internal tools, the number of available functions per server is only going to grow. Whether identity-scoped tool lists become a standard default across the MCP ecosystem — rather than an Okta-specific pattern — will likely depend on how quickly other identity and infrastructure providers follow with comparable tooling.
Editorial Note
The research heavily corroborates all major factual claims in the article. However, the sources are almost exclusively Okta's own publications and partner materials (MarkTechPost, Medium), providing limited independent verification. The article accurately represents Okta's stated approach to MCP scoping, token management, and the on-behalf-of model, but lacks third-party validation of the economic claims or independent assessment of efficacy.
Claim Tracker
AI-assessed
Source 3 (Okta newsroom) confirms the concept of tool selection costs and token overhead from tool exposure in MCP servers
Source 2 (Okta blog on Securing Serverless AI Agents) explicitly states: 'Access tokens issued for agents should be valid for a short period only (minutes, not hours) and tied to specific MCP tools (e.g., documents.read vs. documents.write)'
Source 4 (Okta blog on Zero Trust for AI agents) confirms: 'the agent acts as a delegate rather than a God Mode administrator' and describes the on-behalf-of (OBO) flow
Source 6 (Okta newsroom article on Cross App Access) confirms this capability exists as of November 25, 2025
Source 3 (Okta newsroom) quotes this exact statement as Okta's position
Ask AI about this story
// discussion
sign in to join the discussion