Part of the hosted on-behalf-of MCP server proposal (#297).
Scope
Audit tools that read process-global configuration for per-user decisions (for example service-account guards) to confirm they are safe for a single-integrator, single-backend hosted deployment. Document the assumption and the rework trigger (one host serving multiple backends with different config).
Acceptance criteria
The assumption is documented; no tool reads mutable global state for a per-user decision outside the documented assumption; affected tools are marked remote-safe only after review.
Dependencies
Informs which tools the default-deny allowlist (#304) can mark.
Part of the hosted on-behalf-of MCP server proposal (#297).
Scope
Audit tools that read process-global configuration for per-user decisions (for example service-account guards) to confirm they are safe for a single-integrator, single-backend hosted deployment. Document the assumption and the rework trigger (one host serving multiple backends with different config).
Acceptance criteria
The assumption is documented; no tool reads mutable global state for a per-user decision outside the documented assumption; affected tools are marked remote-safe only after review.
Dependencies
Informs which tools the default-deny allowlist (#304) can mark.