Skip to content
T threat.cafe

Tag

#mcp-allowlist

2 posts

  1. · Nadia Ferreira-Strand · Enforcement architecture · on threat.cafe

    Prove your agent policy fires: a harmless canary suite for Claude Code hooks and MCP allowlists

    Several hook and allowlist settings fail open without an error. Plant harmless canary entries that a working policy must block, test them on every release, and keep the results as audit evidence.

  2. · Desmond Okafor-Hale · Governance and leadership · on threat.cafe

    Are built-in agent protections enough? What auto mode, MCP allowlists, store scanning and skill scanning cover

    Native agent controls are real, and each covers its own surface: one client, one store, one upload path. The residual risk sits across vendors, across registries and after approval. A coverage map with the blank cells left blank.