Argument-Aware Runtime Least-Privilege Enforcement Against Tool-Poisoning-Induced Actions in MCP-Based Agentic Systems

Tool poisoning can induce Model Context Protocol (MCP) agents to perform harmful host-side actions through manipulated tool metadata or invocation arguments. This paper studies a client-side least-privilege capability-inference mechanism that translates concrete tool names and recursively structured arguments into six behavioural categories before policy lookup. On a review-driven audit of 27 calls labelled from documented official MCP reference-server semantics, the corrected mapper obtains 27/27 exact category sets. On 16 author-instantiated, external-provenance MCPTox cases, it recovers all specified minimum capabilities with three additional conservative categories; neither set constitutes blind generalisation evidence. A separate policy matrix yields 27/27 expected decisions. An independently implemented declared-capability policy comparator agrees with B4 on 170/172 decisions across four profiles, including 43/43 under limited-network (0% ASR; 59.26% benign-call allow rate). Hardened launch validation rejects eight malformed or bypass specifications. Twelve live stdio checks verify tool discovery, two benign workflow outputs, denied-write non-execution, error propagation, ASK denial, symlink protection, and upstream-crash failure. The 20-workflow authorisation replay is reported separately from executed task success. The contribution is automatic name/argument-to-capability inference and bounded enforcement evidence, not universal interception or confinement of malicious server internals.