alt Hacker NewsHow do you segregate the CLI interface the LLM sees versus a human? For example if you’d like the LLM to only have access to read but not write data. One obvious fix is to put this at the authz layer. But it can be ergonomic to use MCP in this case.
Replies
jyaohao • yesterday at 10:16 PM
I’ve been testing with an ENV variable for a cli tool for LLMs that I’m making. Basically, I have a script that sets an ENV variable to launch the TUI that I want and that ENV variable changes the behavior for LLMs if they run it (changes the -h output, changes the default output format to json to make it easier to grep)
coppsilgold • today at 2:29 AM
Containers, virtual machines, jails.
Containers have jail runtimes available. See for example gVisor/runsc.
➕ show 1 reply
I've been running Claude Code in a Docker compose environment with two containers - one without Claude that has all the credentials setup and a Claude container which transparently executes commands via ssh. The auth container then has wrappers which explicitly allow certain subcommands (eg. `gh api` isn't allowed). The `gh` command in the Claude container is just a wrapper script which bassically `ssh auth-container gh-wrapper`.
Lots of manual, opinionated stuff in here, but it prevents Claude from even accessing the credentials and limits what it can do with them.