Okta Says Smarter MCP Tool Access Could Cut AI Agent Token Costs by Over 90%

 

Identity-based tool filtering may help enterprises reduce AI costs while improving security and limiting agent access

AI agents connected to large numbers of enterprise tools may be wasting significant amounts of tokens before they even perform a single task.

Identity and access management company Okta says one solution is to limit which Model Context Protocol, or MCP, tools an AI agent can see based on the permissions of the agent and the user operating it.

Okta describes the unnecessary token consumption caused by large tool lists as a "tool tax."

Every time an AI agent sends a request to a large language model, the prompt may include the names, descriptions, parameters, and schemas of every tool exposed by an MCP server.

The model must process all of that information, even if it will never use most of the tools.

According to Okta, filtering those tools before they reach the AI model could reduce that overhead dramatically.

In some of its internal modelling, Okta found that identity-based permission controls reduced the number of tools visible to an AI agent by more than 90%.

The company said tool-schema token usage dropped by approximately the same proportion.

Okta did not provide specific dollar savings or absolute token counts.

What Is the MCP "Tool Tax"?

Model Context Protocol has become an increasingly important standard for connecting AI agents to external applications, databases, and enterprise services.

An MCP server can give an AI agent access to tools from platforms such as Google Workspace, Slack, internal company systems, databases, and other software.

However, there is a hidden cost.

Before the model decides which tool to use, it may already receive information about every available tool.

That can include:

• Tool names
• Tool descriptions
• Input parameters
• Output structures
• Authentication-related information
• Tool schemas

For a small MCP server, the cost may be minor.

But in enterprise environments with dozens or hundreds of tools, the prompt can become significantly larger.

Multiply that by thousands of users and millions of AI requests, and the token overhead can become an important operational cost.

Rejecting Unauthorized Calls Does Not Recover Tokens

Traditional security controls may allow an AI agent to see a tool but block it when the agent attempts to execute an unauthorized action.

From a security perspective, the action may still be prevented.

But the model has already processed the tool definition.

The tokens have already been consumed.

Okta argues that authorization therefore needs to happen earlier.

Instead of presenting the model with every tool and blocking unauthorized calls later, Okta proposes filtering the tool list before the AI prompt is created.

Okta Wants AI Agents to See Only the Tools They Can Use

Under Okta's approach, administrators define which tools a specific identity is authorized to access.

The identity may belong to an AI agent, a human user, or potentially a combination of both.

Okta then returns only the MCP tools permitted for that identity.

If an employee has access to five tools out of a server containing 100 tools, the AI model would receive information about only those five tools.

The remaining 95 tools would never appear in the prompt.

This reduces the number of tool schemas that the model must process.

Okta says the same permissions would also be checked again when the AI agent attempts to execute a tool.

That creates two layers of control.

The first determines what the AI agent is allowed to see.

The second verifies what the AI agent is allowed to execute.

Least Privilege for AI Agents

The concept is closely related to the cybersecurity principle of least privilege.

A user, system, or AI agent should have access only to the resources required to perform its assigned task.

Okta argues that this principle should now apply directly to MCP tools.

An AI agent designed to handle customer support, for example, may need access to customer records and ticketing systems.

It probably does not need administrative access to employee accounts, financial databases, or infrastructure management tools.

Removing those unnecessary tools from the AI model's context could improve both security and efficiency.

Internal Testing Showed More Than 90% Tool Reduction

Okta tested the concept using internal modelling based on its own product information and publicly available vendor documentation.

The company said no customer data was used.

It modelled a single MCP client connected to a catalogue of enterprise tools.

Okta then mapped individual MCP tools to the OAuth scopes required to access them.

Representative roles were created, including:

• Helpdesk read-only users
• Helpdesk operators
• Application administrators
• Brand administrators
• Email administrators
• Super administrators

The company compared the full tool catalogue with the smaller tool set that would be available to each role.

In some scenarios, the number of tools presented to the AI model fell by more than 90%.

Okta says token consumption related to tool schemas should decrease at roughly the same rate because every additional tool contributes additional schema information to the prompt.

Actual savings would depend on several factors, including the number of available tools, the average size of each schema, user permissions, request volume, AI model pricing, and how frequently agents make model calls.

Why This Matters for AI Costs

The concept highlights an emerging issue in agentic AI.

Companies often focus on the number of tokens contained in the user's question and the AI model's response.

But AI agents can carry additional hidden context.

System prompts, memory, retrieved documents, tool descriptions, schemas, and other instructions can all increase the number of tokens processed during every model call.

As enterprise AI systems become connected to more applications, tool definitions could become a meaningful part of that cost.

Reducing unnecessary tools could therefore become another method of optimizing AI infrastructure.

Identity Controls vs AI Gateways

Okta also distinguishes identity-based access control from AI gateway cost controls.

An AI gateway can monitor or limit:

• Token usage
• API spending
• Rate limits
• Model routing
• Request volume

Those controls help organizations manage how much AI systems consume.

Identity-based MCP filtering addresses a different problem.

Instead of limiting spending after an AI request is generated, the system reduces the amount of tool information entering the prompt in the first place.

The two approaches could potentially work together.

A gateway could monitor overall AI consumption, while identity controls determine which MCP tools each agent is allowed to see.

Smaller Tool Lists Could Also Reduce Security Risks

The potential benefit is not limited to token costs.

Okta says limiting tool visibility could also reduce the potential attack surface of AI agents.

If an AI agent becomes compromised, the attacker would theoretically have access only to tools assigned to that identity.

Tools outside that permission scope would not appear in the model's available tool list.

This could reduce the possible damage associated with compromised AI credentials or manipulated agents.

In cybersecurity terms, it reduces the potential blast radius.

Identity Could Become a Major Layer of Agentic AI

As AI agents become capable of interacting directly with corporate systems, identity management may become increasingly important.

Traditional employees have usernames, roles, permissions, and access policies.

AI agents may soon require similar governance.

Organizations may need to answer questions such as:

Who is this AI agent?

Which human user is operating it?

Which systems can it connect to?

Which MCP tools can it see?

Which actions can it perform?

What happens if its identity is compromised?

Okta's proposal suggests that identity systems could become one of the core infrastructure layers behind enterprise AI agents.

The biggest lesson here is simple.

More AI tools do not automatically mean a better AI agent.

Giving an AI model access to hundreds of unnecessary tools can increase token consumption, increase complexity, and potentially increase security exposure.

The smarter architecture may be to show an AI agent only the tools it actually needs.

If Okta's modelling translates into real enterprise deployments, identity-scoped MCP tool lists could become an important technique for reducing AI operating costs while strengthening security.

For companies building large agentic AI systems, the next optimization battle may not only be about choosing cheaper models.

It may also be about deciding which tools the AI is allowed to know exist.

Okta is also listed as a key sponsor of an upcoming event in Amsterdam scheduled for October 19 to 20, 2026, although the source material does not specify the event name.