A developer exposes a database function as an MCP tool. Which design best limits its potential impact?

1. An arbitrary SQL execution tool owned by a highly privileged account
2. A narrowly scoped operation with validated arguments and minimum privileges
3. A tool accepting database credentials inside every natural-language argument
4. A tool whose authorization relies only on its reassuring name