Benefits with Ory + Model Context Protocol Time MCP Server
Use Cases
— 01 use caseAgent IAM
Most agents need only Read to check and convert times, sandboxed helpers can be set to Block, and Write or Admin grant nothing more here.
Core Functionality
— 04 capabilitiesRead, write, admin, or no access
Ory Agent Security classifies every tool on the Time MCP reference server as read, write, or admin, and because the Time MCP reference server only reports and converts times, the choice for each user, team, or agent type comes down to read for any agent that schedules work or analyzes logs or no access for sandboxed helpers you want fully isolated.
Enforced before execution
Ory Agent Security checks each tool call against the user, the agent acting for them, and any sub-agent inside the agent harness, so a denied call stops before it reaches the server, with nothing to roll back and no gateway to deploy.
Observe, then enforce
Observe mode shows which agents use the Time server at all without blocking anything, so you can apply Ory's pre-built policy for the Time MCP reference server and enforce it on your own schedule.
Complete audit trail
Every allow and deny decision on the Time MCP reference server streams to your SIEM through OpenTelemetry with the user, agent, and action attached, so you can show the full sequence of an agent's calls, including the low-risk ones.