Unsafe tools (shell, background processes) gated behind explicit permission #24

New issue

Open

opened 2026-05-07 01:30:04 -04:00 by jasoncouture · 1 comment

jasoncouture commented

2026-05-07 01:30:04 -04:00

(Migrated from github.com)

Shell execution and background-process tools — gated behind explicit permission (per-agent, per-call, or both). The kind of capability that's amazing when it's wanted and catastrophic when an agent reaches for it without authorization.

Depends on the tool security model (#23).

Tracked in TASKS.md.

jcouturest commented

2026-05-26 15:10:22 -04:00

(Migrated from github.com)

Tool metadata was updated to surface the various metadata hints, which will enable this.
Additionally, a tool security model was added recently, and #23 ( Completed in #109 ) is done.

The hints currently surfaced from MCP to the internal representation are:
readOnlyHint
destructiveHint
idempotentHint
openWorldHint

Tool metadata was updated to surface the various metadata hints, which will enable this. Additionally, a tool security model was added recently, and #23 ( Completed in #109 ) is done. The hints currently surfaced from MCP to the internal representation are: `readOnlyHint` `destructiveHint` `idempotentHint` `openWorldHint`