tag: #mcp

People install Claude Code, Codex, and Cursor in five minutes and never ask what the thing can actually reach. The answer is everything you can - your files, your network, your keys. The documented 2026 attacks are mundane, a JSON config in a cloned repo that runs commands before the trust dialog, a crash report that smuggles a shell command through a tool you trust. Here is the real threat model and how to bound it, up to my tank-os-with-llms box.

Most people run an AI to write code and then review the output by hand. The step almost nobody adds is the feedback loop - let the CI pipeline produce a report, hand it back to the AI, and let it fix its own mistakes on the feature branch before a human ever looks. It cuts the amount of AI code you have to review by a lot, because the model catches its own garbage first.