An MCP server is being designed to expose a company's internal SQL database to Claude-powered agents. The server implements a run_query tool that accepts arbitrary SQL strings. During a security review, a red-teamer demonstrates that an agent can be prompted to run DROP TABLE via this tool. What MCP server-side control is the most appropriate architectural response?

The correct architectural response is replacing the run_query tool with a set of narrowly scoped tools, such as get_customer, list_orders, and search_products, that map to parameterized queries and eliminate free-form SQL input at the tool interface. The root vulnerability is the free-form SQL interface, which provides no structural constraint on what operations an agent can perform. Narrowly scoped tools that call parameterized queries eliminate SQL injection and privilege escalation at the architectural level, because the agent can never formulate DROP TABLE when no tool accepts arbitrary SQL. An input validation approach that rejects any SQL string containing DDL keywords before execution is wrong because keyword blocklists are easily bypassed through comment injection, Unicode normalization, or obfuscated DDL; they add friction but do not close the vulnerability. A confirmation step in the Claude agent's system prompt instructing it to ask the user before executing modifying SQL is wrong because it is a model-layer control, not a server-layer control; an adversarially prompted agent, a model update, or a jailbreak could bypass it, and architectural controls must not rely solely on model behavior. Enabling MCP tool call logging and alerting the security team when DDL patterns are detected in tool arguments is wrong because it is a detective control, not a preventive one; it detects the attack after damage has already been done.