Skip to content
T threat.cafe

Tag

#claude-code

9 posts

  1. · Tobias Lindqvist-Rao · Agent artifact supply chain · on threat.cafe

    Skills inherit everything your agent can touch: scoping credentials and shell access per skill and MCP server

    A skill or local MCP server runs with the agent's environment, files and network. The working least-privilege unit is the credential and command surface each one can reach, set in sandbox, permission and server config, not in the prompt.

  2. · Priya Venkatraman · Enforcement architecture · on threat.cafe

    Allowlist, denylist or both? Designing MCP server policy after GitHub's enterprise allowlists

    An allowlist stops servers nobody approved. A denylist stops approved servers that later turn bad. MCP policy needs both, matched on URL or command, never on name alone.

  3. · Tobias Lindqvist-Rao · Enforcement architecture · on threat.cafe

    Five Claude Code hook settings that quietly turn agent enforcement into advice

    Exit 1 does not block. A timed-out hook does not block. The if filter is best-effort. Plugin tools carry prefixed names. User hooks merge in unless managed-only mode is on. Check all five before you call a hook a control.

  4. · Tobias Lindqvist-Rao · Original research and datasets · on threat.cafe

    Do coding agents call optional security tools on their own? What the docs guarantee, and a 50-task test to run

    Nothing in the MCP spec or Claude Code's docs makes an agent call a security-check tool before it installs something. The model decides. Here is why, and a pre-registered 50-task protocol to measure it on your own setup.

  5. · Constance Ibe-Whitmore · Governance and leadership · on threat.cafe

    Two-thirds of AI users at work use personal accounts: moving coding agents to managed tenancy without a ban

    DBIR 2026, via CRI, says 67% of AI users reach AI through non-corporate accounts on work devices. For coding agents that means no org policy on tools that run commands. Make the managed path easier, then enforce it on the device.

  6. · Tobias Lindqvist-Rao · Enforcement architecture · on threat.cafe

    Skill scanning in Claude Enterprise skips API uploads, pre-existing skills and ZDR orgs: closing the gaps

    Claude Enterprise skill scanning checks new uploads and edits in claude.ai and Cowork. Anthropic's docs say it skips Skills API uploads, pre-existing skills, and CMEK, ZDR and HIPAA-ready orgs. A control for each gap.

  7. · Nadia Ferreira-Strand · Enforcement architecture · on threat.cafe

    Prove your agent policy fires: a harmless canary suite for Claude Code hooks and MCP allowlists

    Several hook and allowlist settings fail open without an error. Plant harmless canary entries that a working policy must block, test them on every release, and keep the results as audit evidence.

  8. · Tobias Lindqvist-Rao · Enforcement architecture · on threat.cafe

    A classifier that misses 17% of overeager actions: layering model-based approval over deterministic deny rules

    Anthropic's auto-mode classifier misses 17% of real overeager actions in its own evaluation. It is a good middle layer. Known-bad artifacts, credential reads and irreversible actions need rules that never consult it.

  9. · Desmond Okafor-Hale · Enforcement architecture · on threat.cafe

    Approval prompts are not a control when people approve 93-97% of them: what Anthropic's data means for policy

    Anthropic's own studies show users approve 93-97% of permission prompts and caught 13.6% of planted dangerous commands. Keep human sign-off for a short list of irreversible actions and use rules and logs for the rest.