Which MCP servers do I run?
A few of my own and a handful of third-party ones. My own MCP server provides a mailbox that Claude, Codex, Pi and Antigravity use to hand tasks to each other. lore makes my session history searchable over MCP. On top of that there is a headless Playwright browser the agents share. I check new tools and servers before adding them.
What permissions does an MCP server need?
As few as possible. A local MCP server runs with the permissions of the process that starts it and can do whatever that process can. That is why my delegated workers run with no-new-privs, so sudo fails there. I added that after a worker once installed a system package. My containers get no SSH keys, no root, no Docker socket and no home directory. If a container needs more, it gets a pinned package in the image or a single folder mounted read-only.
Where do the secrets live?
Not with the agent. Credentials are in 1Password, and the agents use a service account that can see only one specific vault. Vaults with private things like finances are out of its reach. I keep the API key for pay-per-use calls in a separate profile outside the agents’ environment. Otherwise a tool would find and use it, and billing would quietly move from the subscription to the API. I do not copy OAuth tokens between tools, and secrets belong neither in Git nor in output.
How do you guard against prompt injection?
I cannot prevent it entirely. An agent reads web pages, mail and files, and any of them can contain text that looks like an instruction. So I limit what it may do afterwards. An agent may only send a mail once I have approved that exact message. These are rules the agents read. I have not tested how well they hold up against a targeted attack.
What if the safety layer itself fails?
Then you often do not notice. My safety hook once stopped working without any error message, because Claude Code had changed its input format. I found the defect, fixed it and then checked it with exactly the command the hook is meant to block. My policy gate has a known limit: on an internal error it lets the command through and logs it. Anyone relying on such a layer should know that.