Infrastructure engineer. Linux, Kubernetes, Go, Python.
Tool-level permissions in MCP servers — which tools a server actually puts in
tools/list, and how to make it hand an agent fewer of them.
The pattern I keep arriving at, which is not original and not complicated: deny writes by default, grant write tools by name, filter the unnamed ones out of the inventory rather than rejecting them at call time, and fail at startup on an unknown name.
Recent patches:
- chigwell/telegram-mcp#168 —
read-only+<tool>,<tool>: a read-only baseline plus named write tools (merged) - Flux159/mcp-server-kubernetes#356 — unknown names in
ALLOWED_TOOLSfail loudly instead of silently (merged) - redis/mcp-redis#161 —
MCP_REDIS_ALLOWED_TOOLS, for a server with no tool-level control (open)
Notes from reading six of these servers line by line, with a file and line for every claim: what MCP servers actually expose. Corrections welcome — the documentation-based survey that preceded it was wrong in both directions.
- What MCP servers actually expose — six codebases, one question
- git-crypt + Trezor — repo encryption key never on disk
- Trezor as a TOTP vault — 2FA secrets encrypted on-device
- Recovering a Trezor GPG identity from a seed phrase — SLIP-0010, no hardware required; answers trezor-agent#335
- claude-skills — reusable Claude Code skills
- trezor-totp · trezor-gpg-recovery — implementations behind the write-ups
- nobsgojobs-go — Go client for a free feed of current Go/backend job postings
- hiddenjump — reverse SSH tunnel through CGNAT