Okta Cracks Down on AI Agent Token Costs with MCP Scoping

In the rapidly evolving landscape of artificial intelligence, the cost associated with enabling AI agents to interact with external tools and data sources is becoming a significant concern for enterprises. Okta, a leader in identity and access management, has introduced a novel approach aimed at drastically reducing these expenses by refining how AI models access and process information about available tools. The company’s Model Context Protocol (MCP) tool lists, when scoped to specific identities, can significantly lower the token consumption, a key driver of AI operational costs.

AI agents, to perform their tasks effectively, often require access to a variety of tools, ranging from enterprise applications like Google Workspace and Slack to internal databases and bespoke services. When an AI agent makes a call to a model, it typically receives a comprehensive list of available tools. This list includes not just the tool names but also their associated schemas, descriptions, and parameters. Okta identifies this comprehensive information delivery as the “tool tax”—tokens that are consumed by the AI model even if the agent ultimately doesn’t utilize all of the provided tools.

The economic impact of this “tool tax” is substantial. Tokens are consumed by the model during its initial consideration of the toolset, regardless of whether a specific tool is eventually invoked. Crucially, Okta points out that a later rejection of an unauthorized tool request cannot recoup these already expended prompt tokens. This is where Okta’s proposed solution offers a strategic advantage. By filtering the list of available tools *before* they reach the AI model, and basing this filtering on the permissions assigned to a specific agent identity and its associated user, Okta aims to eliminate unnecessary token expenditure.

Okta’s internal modeling has demonstrated the profound impact of this identity-scoped approach. In some permission scenarios, the number of visible tools was reduced by over 90%. Consequently, the company reported a proportional decrease in tool-schema costs, though precise dollar figures were not disclosed. This suggests a direct correlation between the reduction in tool visibility and the savings in token expenditure, as each tool’s schema contributes to the overall prompt size.

MCP Tool Schemas Create Prompt Overhead on Every Turn

MCP servers have emerged as a critical conduit for bridging the gap between AI agents and the vast array of tools and data sources they need. Okta highlights connections to widely used platforms like Google Workspace and Slack, alongside internal MCP servers, as prime examples of this integration. The challenge arises when an MCP server exposes a large number of tools. On each interaction, the AI model is presented with a detailed representation of every tool available to the agent. This representation includes the tool’s schema, name, description, and parameters, all contributing to the prompt’s token count.

The cumulative effect of this “tool tax” can be significant, especially for widely deployed MCP servers with extensive tool catalogs. Every active user, through their AI agent’s model calls, incurs this prompt overhead. Okta frames this as a dual problem: a “tool-count problem” arising from the sheer volume of available tools and a “user-count problem” as this overhead is replicated across a user base.

Beyond cost, there’s a critical access-control dimension. An AI agent that is aware of tools beyond its authorized scope may attempt to interact with them. While runtime controls can block the execution of unauthorized requests, the AI model has already processed the tool definition and consumed tokens for it. This scenario highlights a gap where security measures are applied too late in the process, after the costly token expenditure has already occurred.

Okta Filters Tools Before the Agent Prompt is Built

Okta positions this new capability as a cornerstone of its “blueprint for the secure agentic enterprise.” This framework emphasizes the need for organizations to clearly define their AI agents, their permissible connections, and their authorized actions. Okta’s innovative approach fundamentally redefines the scope of connection, shifting from broad access to an entire MCP server to granular access to individual tools within that server.

Administrators can now meticulously configure which tools a specific identity is permitted to use directly within the Okta dashboard. Instead of providing the AI agent with the MCP server’s entire tool catalog, Okta returns a precisely scoped set of authorized tools. This restricted list is then what the AI agent receives in its prompt for each turn, significantly reducing the token overhead. Okta further bolsters this by performing a scope check at runtime, just before a tool call is executed, ensuring that only authorized actions are taken.

This design embodies the principle of least privilege at the tool level. Okta’s philosophy is that an AI agent should not be aware of or have access to resources, databases, or tools for which it has not been explicitly authorized. By removing unavailable tools from the prompt entirely, Okta effectively eliminates their schema-related token costs from the model call. While Okta did not present data from live customer deployments, their findings are based on extensive internal modeling utilizing Okta product data and publicly available vendor documentation.

Internal Model Used OAuth Scopes and Representative Roles

To substantiate their claims, Okta developed a sophisticated internal model. This model simulated a single MCP client with access to a comprehensive enterprise tool catalog. The core of the simulation involved comparing the number of tools visible to the AI model before and after the implementation of identity-based scoping.

To accurately estimate the scoped exposure, Okta meticulously mapped the tools within their MCP Server to the corresponding OAuth scopes that grant access. Subsequently, they defined a series of representative user segments, encompassing roles such as helpdesk read-only users, helpdesk operators, app administrators, brand and email administrators, and super administrators. Each segment was weighted according to an assumed share of monthly traffic, providing a realistic distribution of user activity.

The calculation of tool-count reduction was derived by subtracting the ratio of scoped tools to unscoped tools from one. The results were compelling, with some scenarios demonstrating the removal of over 90% of visible tools. Okta’s report elaborates that the token cost associated with tool schemas tracks tool count almost linearly. This is because each tool contributes its name, description, and parameter schema to every prompt, making a direct reduction in tool count translate directly into reduced token usage.

Okta acknowledges that actual cost savings will vary based on several factors, including the specific tool catalog, the distribution of permissions across user segments, and the particular AI model being utilized. Furthermore, average schema size, request volume, and the pricing model of the chosen AI service will also influence the absolute token and dollar costs. Despite these variables, the fundamental principle of reducing prompt complexity through identity-based scoping remains a powerful lever for cost optimization.

Okta Contrasts Identity Entitlements with Gateway Spending Controls

Okta’s whitepaper carefully distinguishes its identity-based scoping mechanism from traditional gateway spending controls. Gateways, while effective for setting overall spending caps based on keys, teams, or groups, and for managing routing and rate limiting, often operate at a higher, less granular level. They can monitor token and dollar flow through a system, acting as a valuable tool for cost control *after* a model decision becomes expensive.

Identity entitlements, on the other hand, provide a more proactive and granular input. Okta argues that per-user and per-agent entitlements can precisely dictate the tools available to a specific agent or the individual it represents, rather than applying access information at a broader group level. This finer-grained control allows for more tailored and efficient resource allocation.

Paul Webber, Principal Cybersecurity Industry Analyst at Software Analyst Cyber Research, commented on Okta’s approach: “Cost control for agents is best provided using identity governance tools that offer more granular control and precision without disrupting business processes. Okta’s approach is an elegant way to do this because it leverages the same entitlement data that governs security, not a separate metering layer without that insight.”

Okta’s framework positions the gateway as a control for what *passes through* it, whereas the identity layer acts earlier in the process, filtering the available tool set *before* those tools even need to be metered. This layered approach ensures that unnecessary costs are eliminated at the source, rather than simply being monitored downstream.

Tool Visibility Also Affects MCP Attack Exposure

The benefits of Okta’s identity-scoped tool access extend beyond cost savings into the critical realm of security. By limiting an unauthorized identity’s visibility to tools it shouldn’t access, Okta simultaneously reduces the potential attack surface. If a compromised identity were to gain malicious access, the range of actions it could perform would be significantly curtailed.

Okta’s proposed scope check operates at two key junctures. The first occurs during the assembly of the tool list for the agent’s prompt. The second, more critical, check happens when the agent attempts to execute a tool call. This dual-layered security ensures that unauthorized access is identified and blocked at multiple points.

The result is a demonstrably smaller “blast radius” for any compromised identity. The remaining exposed tools dictate the set of actions available to that identity. In Okta’s model, the prompt contains only those tools directly associated with the identity’s authorized OAuth scopes, thereby minimizing potential exposure.

For organizations grappling with the complexities of MCP access, a thorough understanding of their tool inventory and a precise mapping of entitlements are paramount operational inputs. Okta’s methodology provides a clear path forward: mapping MCP Server tools to their unlocking OAuth scopes and then comparing the comprehensive tool catalog against the scoped catalog visible to each representative user segment. This systematic approach enables organizations to proactively manage costs and bolster their security posture in the age of agentic AI.