Sanitize

1. Config MCP RBAC:

• Developers can configure specific rules to block the agent from accessing critical system files or running forbidden commands like curl or rm.
• Do not let users connect to arbitrary servers. Vet and approve servers before they can be used.

2. Separate Agent Context With/Without external Tools

• Separate high-privilege tools (rm, DB) and external MCP. Apply least privilege.
• The agent isolates user instructions from data retrieved by tools (like code files or web pages).
• This helps prevent malicious payloads inside tools from being treated as direct commands.
• (lethal trifecta): never combine private data + untrusted content + an exfil channel in one agent context.

3. Human Approval:

• Claude Code requires explicit developer approval before it runs any sensitive tools or shell commands.
• If a poisoned tool tries to silently execute a dangerous script, a human must approve it first.
• Before the agent executes destructive or data-exfiltrating actions, prompt the user for approval outside the LLM context.

4. Hooks: Pre-tool - server-side restrictions

• Do not rely on system prompt instructions to restrict tool access.
• Implement access controls at the tool execution layer so injected instructions cannot override them.
• This allows the CLI client to vet the action before handing it over to the underlying Large Language Model (LLM).