Check an MCP agent before it touches real power.

Every tool is classified as read-only, reversible write, irreversible write, money-moving, credential-bearing, or external-send.

Irreversible actions show exact target, amount, path, endpoint, or account before execution.

Spending, sending, deleting, deploying, and production writes have explicit rate, budget, and destination limits.

Tool names, descriptions, schemas, and remote metadata are treated as untrusted input and reviewed for hidden instructions.

Web pages, files, emails, tickets, rows, and tool outputs are treated as data, not authority.

New or changed high-risk tool parameters fail until reviewed and tested.

Tokens are audience-bound where possible, stored safely, and never blindly passed through to unrelated services.

The agent has an explicit refusal path for revealing secrets, exporting credentials, or changing its own rules.

Logs capture tool choice, final arguments, confirmation state, and source data used for high-impact actions.

The launch pack includes normal, missing-context, malicious-document, malicious-tool-description, and changed-recipient tests.

Trusted MCP servers, actions, and tool schemas have versions or review dates.

The agent asks for clarification when confidence, context, identity, recipient, or authority is uncertain.