No permission or tool scope declared
HighAV-PERM-001PermissionsCore pack
What it finds
No `permissions`/`scope`/`tools` allowlist pattern and no wildcard pattern anywhere in the content.
Why it matters
Without a visible scope declaration, there is no way to confirm what this agent is actually allowed to do — it may be running with default or inherited access not shown here.
How to fix it
Declare an explicit permission or tool allowlist so this agent's access boundary is visible and reviewable.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- OVERPERMISSIONED_SCOPE
- How it detects
- Flags a safety control that should be there but is not.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Agent/tool config with permission or scope declarations
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Overly broad cloud IAM permissionsAV-PERM-003 · Critical
- AI workflow checks out untrusted PR code with secretsAV-PERM-007 · Critical
- Agent's Kubernetes account has cluster-adminAV-PERM-008 · Critical
- Unscoped delegation detectedAV-PERM-002 · High
- LangChain SQL agent with unrestricted database accessAV-FW-002 · High
- Retrieval with no per-customer filterAV-DATA-007 · High