A public-health records team is configuring Model Context Protocol servers for its coding agent and needs the agent to read schema definitions for development work without ever having a path to protected health data rows. Which approach best meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
Think of an MCP server like a hotel key-card system: you can hand out cards that open the supply closet without ever cutting one that opens a guest room. Splitting endpoints by what they return, schema metadata on one, patient rows on another, means the agent physically has no path to the sensitive data, not just a polite instruction to avoid it. A system prompt telling the agent not to peek is a suggestion; a missing endpoint is a boundary.
Full Explanation
The mechanism here is capability separation at the tool layer: an MCP server can register multiple distinct tools, and each tool's implementation determines what data it can return. Registering a schema-only tool that queries metadata views, and never registering a tool that surfaces row-level PHI, makes exfiltration structurally impossible rather than merely discouraged. This applies least-privilege thinking to agent tool access the same way it applies to human IAM roles.
The full-access-plus-instruction approach fails because a system prompt is guidance the model can be steered around through prompt injection, ambiguous requests, or its own reasoning errors, so it doesn't constrain the actual capability granted. Bypassing MCP with direct credentials removes the abstraction layer that lets the team audit and scope tool calls at all, trading a controllable integration point for an unscoped one. Encrypting data at rest protects against storage compromise but does nothing about an authorized query returning plaintext rows to the agent at runtime, since decryption happens before the agent ever sees the response.
Scope caveat: the schema endpoint itself still needs review so its metadata output doesn't leak sensitive column names or sample values. A concrete check: run a test query against the agent's actual tool set and confirm no path returns a real patient record, not just review the documented endpoint list.