1. Minimize the catalog for each task
Expose only the tools required for the current assignment. Every filesystem reader, external writer, browser, code runner or payment function increases potential impact even when it is never called.
2. Treat annotations as untrusted hints
readOnlyHint, destructiveHint, idempotentHint and openWorldHint improve review but come from the server. Apply conservative defaults when absent, and escalate contradictions with names, descriptions or schemas.
3. Analyze combined authority
A private-data reader plus an external publishing tool creates an exfiltration path even if each tool looks reasonable alone. Code plus open network, credentials plus messaging, and privilege changes plus egress require isolation.
4. Confirm immediately before consequence
Deletion, payment, publication, messaging, identity and permission changes need human approval with parameters and destination visible. Confirmation must be enforced outside model reasoning.
5. Enforce verifiable boundaries
Restrict filesystem roots, commands, domains, token audiences, lifetimes and quotas in authorization and execution layers. Preserve a review packet that omits the raw catalog and secrets.
Frequently asked questions
H/M Blindspot · hogarmas.net
Does a clean report prove the agent is safe?
No. Static analysis cannot prove implementation behavior, authorization, isolation or runtime conduct.
Is the catalog uploaded or are tools executed?
No. Agent Scope analyzes JSON inside the browser and does not open destinations, call models or execute tools.
Do MCP annotations enforce permissions?
No. They are review metadata. Real permissions need authorization, sandboxing, network controls and external confirmation.