An agent definition, which is mostly a list of prohibitions. The last instruction is the one that matters and it is the one a general-purpose assistant gets wrong…
A runtime permission model re-evaluated a year after the first look, with the same conclusion for the same reason. Re-running an evaluation and reaching the same conclusion is…
A protocol server for a database, and the constraints that make it safe rather than the capabilities that make it useful. A read-only credential is the floor rather…
turkerdev/mysql-mcp, and what a protocol for tool access actually requires. The authorisation model is the host’s problem, which means it is all yours.
Third-party actions pinned to a commit, and a bump pull request that a human can actually review. The bundled dist file being unreviewable is the honest part of…