Capability Bloat
GovernanceDefinition
The design flaw of giving an agent more, or more powerful, tools than its role genuinely requires. Capability bloat harms security (a hijacked agent can invoke a capability it never needed), reliability (tool-selection accuracy drops as the tool set grows and descriptions overlap), and cost (every tool definition consumes context tokens on every request). The fix is least privilege by removal -- eliminating the capability entirely -- not adding logging or confirmation prompts around it.
Why It Matters for the Claude Certification Exams
CCAR-P integration and CCDV-F tools items treat extra tools as extra blast radius. The fluent-looking answer is "connect every MCP server"; the scored answer is least privilege for the role.
In Depth
Capability bloat is the design flaw of giving an agent more tools, or more powerful tools, than its role requires. A support-summarizer that can also Bash, send email, and write to production is not "future-proof." It is a confused-deputy waiting for a prompt injection.
Three harms the exams care about
- Security. A hijacked or injected agent can only invoke what you exposed. Every extra MCP server and every extra Bash allow-rule expands the blast radius. Least privilege belongs in
settings.jsonpermissions and in the tool list, not in a CLAUDE.md plea to "be careful." - Reliability. More tools mean more chances to pick the wrong one, more schemas in context, and more failure modes (timeouts, auth errors) the orchestrator must handle. Progressive discovery is the context-side twin of this idea.
- Operability. Each tool is a dependency you must auth, log, version, and eval. Teams that bolt on every internal API "because we might need it" cannot explain what the agent is allowed to do.
What to do instead
Define the job, then list the minimum tools that job needs. A retrieval agent needs search and fetch, not deploy. A Claude Code review skill should allowed-tools Read and Grep, not Write. If a rare task needs a powerful tool, make it a separate agent or a human-approval path, not a standing capability on the default loop.
Capability bloat is the opposite of a generous platform instinct. The architect's reflex on CCAR-P is to subtract. The developer's reflex on CCDV-F is to write a tight schema and a tight allow-list. See Tool interface design and Confused deputy.
Frequently Asked Questions
Is it capability bloat to expose a read-only MCP server the agent uses on most turns?
No. Bloat is extra or over-powered capability relative to the role. A tool the job actually needs, scoped read-only, is appropriate — still describe it tightly.
Can CLAUDE.md instructions fix an oversized tool list?
No. Instructions are advisory. An injected prompt can ignore them. Remove the tool or deny it in settings.json if the role should not have it.