alt Hacker NewsWe do give our customers guidance to make sure they are thinking about this properly. This typically happens during on-boarding.
We also built out pre-defined controls for common tools so they can click a button and not think about it.
We do give our customers guidance to make sure they are thinking about this properly. This typically happens during on-boarding.
We also built out pre-defined controls for common tools so they can click a button and not think about it.
Food for thought, tool and MCP calls run locally, but every request carries the tool list and every response carries the model's tool calls, both of which pass through you. You could strip non-approved tools from the request and block calls to them in the response, based on an org allowlist. That gives you org-approved MCP/tool calls without touching the dev's machine.