We Trusted the Tool Descriptions. That Was the Bug.

Notes from a product team on putting an MCP trust boundary around a frontend/ops agent: allowlists,...