Q3 of 60 — CCA Practice Exam

Multi-Agent Research System

Your multi-agent research system uses Claude Code's agent SDK to orchestrate three subagents: a web-search agent, a database agent, and a Slack-notification agent. During a security review, your team finds that the database agent — which should only run read-only queries — is also capable of invoking the mcp__db__insert and mcp__db__delete tools. Examining the agent configuration, you find the orchestration layer was originally set up with permissionMode: "bypassPermissions" to avoid approval prompts during development, and that setting was never changed for production. What is the most targeted fix to restrict each subagent to only the MCP tools it requires?

A. Replace permissionMode: "bypassPermissions" with permissionMode: "acceptEdits", which restricts automatic MCP tool approval and requires confirmation for database mutations.

B. Add a system prompt instruction to each subagent specifying which MCP tools it is permitted to call, and instruct the orchestrator to reject any subagent response that references a disallowed tool.

C. Remove permissionMode: "bypassPermissions" and configure each subagent's allowedTools with explicit per-server grants — for example, "mcp__db__query" only for the database agent — scoped to exactly the tools each role requires.

D. Move MCP server configuration from the agent SDK options into a shared .mcp.json file at the project root, and rely on the project setting source to enforce per-agent access boundaries.