Per-conversation tool scoping — delegation-based MCP governance for multi-user deployments

[aeoess]

LibreChat supports multi-user deployment with agents and MCP tools. The current auth model handles user authentication well, but the gap is between the user and the agent: once a user starts a conversation with an agent that has tools enabled, the agent has full access to every configured tool. There's no per-conversation, per-agent scope constraint.

For organizations running LibreChat as their internal AI platform, this means:

• An agent in a customer support conversation has the same tool access as an agent in an engineering conversation
• A user can't delegate limited authority to an agent ("search the web for me, but don't access internal databases")
• When an agent misuses a tool, the only evidence is server logs — no cryptographic proof of what the agent was authorized to do

Delegation scoping per conversation:

import { createDelegation, governMCPToolCall } from 'agent-passport-system'

// User starts a conversation → system creates scoped delegation
const conversationDelegation = createDelegation({
  delegatedTo: agentSessionKey,
  delegatedBy: userKey,
  scope: ['tool:web_search', 'tool:calculator'],  // only these tools
  spendLimit: 0,    // no purchases
  expiresAt: sessionExpiry,
  maxDepth: 0
})

// Agent tries to call an MCP tool → governance checks scope first
const result = await governMCPToolCall(
  { name: 'database_query', arguments: { sql: 'SELECT * FROM users' } },
  async (args) => mcpTool.execute(args),
  { passport: agentPassport, delegation: conversationDelegation, privateKey: sessionKey }
)
// Blocked: database_query not in delegation scope
// Receipt generated with signed denial proof

This integrates at the MCP tool execution layer. The delegation is created when the conversation starts (based on user role, selected preset, or explicit choice). Every tool call goes through governance before reaching the MCP server. The receipt trail gives admins per-conversation audit visibility.

npm install agent-passport-system (v1.36.2, Apache-2.0). Gateway at aeoess.com/portal.html for hosted enforcement.