Okta says identity-scoped Model Context Protocol (MCP) tool lists can reduce AI agent token costs. The company is targeting a specific inefficiency: AI agents waste tokens on tool descriptions they never use.
What is the "tool tax" in AI agents?
According to Artificial Intelligence News, each model call made by an AI agent can include schemas, names, descriptions and parameters for every tool exposed by a MCP server. Okta calls the resulting prompt overhead the "tool tax": tokens consumed as a model considers tools, including those it will never call.
The problem is straightforward. When an AI agent makes a call, the model receives a full list of available tools. Even if the agent only needs one tool, the model processes information about all of them. That processing costs tokens — and money.
Why rejection cannot recover token costs
Okta argues that this cost appears before an agent attempts a tool call. A later rejection of an unauthorised request therefore cannot recover prompt tokens already consumed. The tokens are spent the moment the model reads the tool list, not when it tries to use a tool.
This is a key insight. Security checks that happen after the model call can stop unauthorized actions, but they cannot undo the token expense that already occurred.
How Okta's MCP scoping solution works
Okta's proposed control filters the list of tools before it reaches the model. The filtering uses permissions assigned to an agent identity and the user associated with it. Instead of sending every available tool to the model, the system sends only the tools that the agent and user are authorized to use.
According to Okta's video explainer, AI agents waste tokens on MCP tool lists even when they never use most of those tools. The identity-based filtering directly addresses this waste.
Okta's internal modelling found that some permission scenarios reduced the number of tools exposed to the model. Fewer tools in the prompt means fewer tokens consumed per call.
What this means for AI agent deployments
For companies running AI agents at scale, token costs add up quickly. Every call that includes a long tool list consumes more tokens than necessary. Over thousands or millions of calls, the "tool tax" becomes a significant expense.
The approach combines two priorities: cost reduction and security. By scoping tools to identity permissions, organizations can cut token usage while also limiting what agents can attempt to access.
This is not just about saving money. It is about making AI agents more efficient by design. A model that sees only relevant tools can make faster, more focused decisions.
Our Take: Identity is the missing layer in AI cost control
Okta's approach makes sense because it addresses the root cause rather than the symptom. Most cost-cutting efforts focus on optimizing prompts or caching responses. Okta is pointing out that the tool list itself is bloated, and identity permissions are the natural filter.
To put it plainly: if an agent does not have permission to use a tool, the model should not even see that tool. This is both a cost saving and a security improvement. The two goals align perfectly.
The "tool tax" concept is worth paying attention to. As AI agents become more common in enterprise workflows, token costs will become a major line item. Solutions that cut waste before it happens — rather than after — will be the most effective.
Okta's internal modelling shows promise, but real-world results will depend on how well the filtering integrates with existing MCP servers and identity systems. Still, the direction is right: fewer tools, fewer tokens, better security.
