Tools that must not run without the operator's explicit go-ahead. Every
write tool, plus run_sandbox: its MCP scope is read, but it executes an
ad-hoc node list for real — outbound calls included — so a prompt injected
through a trace or a documentation page could otherwise drive it unattended.
Tools that must not run without the operator's explicit go-ahead. Every write tool, plus
run_sandbox: its MCP scope isread, but it executes an ad-hoc node list for real — outbound calls included — so a prompt injected through a trace or a documentation page could otherwise drive it unattended.