[mrgaro]

Another examole which is trivial with MCP but hard with cli binaries: blocking certain commands, such as write operations from the agent. With MCP your client can easily have a blocklist for commands, but with cli you would need to code custom logic for each cli separately.

[dropofwill]

Just use scopes in the API key the agent uses? If you’re exposing something publicly that should be a requirement anyways.

That’s how I use gh, aws, etc. No need to modify any of the code in the cli, they’re just wrappers.

[mikojan]

I want the harness to use read freely but require confirmation for write.

[whattheheckheck]

Server implementers have an information advantage than the client coders wiring clis together to do a job

[octoberfranklin]

Access control is the operating system's job, and modern OSes already provide plenty of great tools for doing that.

Just use the existing sandboxing infrastructure like bubblewrap, seccomp, etc. I have way more faith in that than in something than some regex-based blocklist.

[CamperBob2]

With MCP your client can easily have a blocklist for commands, but with cli you would need to code custom logic for each cli separately.

Nah. Just don't let your model do anything potentially destructive until three or four other models have vetted the proposed action.

Filtering individual commands can never provide more than the shallowest semblance of security. If a smart model is hellbent on deleting your production database, it will write its own Python program to do it if the usual commands are blocked.