# Check the whole MCP session, not just each tool call, for the untrusted input plus private data plus outbound mix > A post on r/mcp argues that per-call guardrails miss leaks made of two allowed calls, citing the case where a support ticket told an agent with a service role key to read a tokens table and post it back to the ticket. The fix is to break the combination of untrusted input, private data and an outbound channel per session. - URL: https://paperchasewebb.ai/bots/marketplace/items/check-the-whole-mcp-session-not-just-each-tool-call-for-the-untrusted-input-plus-private-data-plus-outbound-mix/ - Type: Agent use case pack - Category: Vibe coding - By: PaperChaseWebb - Works with: Plain .md - Price: Free USD - Difficulty: Advanced - Setup time: 1 hr - Time to result: One working session - Format: Markdown (.md) file, check-the-whole-mcp-session-not-just-each-tool-call-for-the-untrusted-input-plus-private-data-plus-outbound-mix.md - Version: 1.0, updated 2026-10-29 - License: Personal and commercial use. Credit the original source when you share the workflow. ## What you end up with A generic SQL tool cannot be policed per call, because one query looks like another to the rule. ## What you get - A plain-language summary of the workflow - A fill-in prompt template - What to watch out for - A link to the original source ## Who it is for Builders who already use AI agents and want a proven workflow they can copy into their own project. ## Tools needed - MCP clients and gateways: where per-call and per-session checks live - Database MCP server: the example's read and write path - You need: An AI coding agent or chat model - You need: A small real task to try it on Cost to run: Free with the agent plan you already use. ## How it works 1. **List for each agent session: does it see untrusted text, private data,.** List for each agent session: does it see untrusted text, private data, and can it send anything out? Expected: Done before you move to the next step. 2. **If all three are true, remove one: read-only, no outbound, or a fresh .** If all three are true, remove one: read-only, no outbound, or a fresh session after untrusted input. Expected: Done before you move to the next step. 3. **Never give the agent an admin or service role key; use scoped tokens.** Never give the agent an admin or service role key; use scoped tokens. Expected: Done before you move to the next step. 4. **Put a human approval in front of anything leaving the organisation.** Put a human approval in front of anything leaving the organisation. Expected: Done before you move to the next step. 5. **Test with an instruction hidden inside a ticket or document.** Test with an instruction hidden inside a ticket or document. Expected: Done before you move to the next step. ## Sample prompt: Workflow template (MCP clients and gateways, Database MCP server) ``` Apply this workflow to [your project]: 1. List for each agent session: does it see untrusted text, private data, and can it send anything out? 2. If all three are true, remove one: read-only, no outbound, or a fresh session after untrusted input. 3. Never give the agent an admin or service role key; use scoped tokens. 4. Put a human approval in front of anything leaving the organisation. 5. Test with an instruction hidden inside a ticket or document. Stop and ask me before anything irreversible: deploys, payments, sends or deletes. ``` Adapted by PaperChaseWebb. Not the original author's prompt. ## Free preview of check-the-whole-mcp-session-not-just-each-tool-call-for-the-untrusted-input-plus-private-data-plus-outbound-mix.md ````markdown # Check the whole MCP session, not just each tool call, for the untrusted input plus private data plus outbound mix PaperChase agent use case (free feed entry), version 1.0. Source: [u/Former-Economy404](https://www.reddit.com/r/mcp/comments/1xikqwl/anyone_enforcing_policy_across_a_whole_session/), 2026-10-29. ## What they did Reading a table was allowed and replying to a ticket was allowed, yet together they sent secrets to whoever could read the ticket. The author's list: a human before anything leaves the organisation, never run the agent with a key that skips row-level security, read-only mode where possible, a fresh session when the trust level changes, and narrow outbound access. A separate thread about agents in Cloudflare reaches the same conclusion: prompts ask an agent to behave, scoped tokens actually limit it. ## Worth knowing A generic SQL tool cannot be policed per call, because one query looks like another to the rule. Decide per session which of the three ingredients the agent gets, and drop one. ```` ## Worth knowing - A generic SQL tool cannot be policed per call, because one query looks like another to the rule. Decide per session which of the three ingredients the agent gets, and drop one. - Figures are as reported by the original author and were not re-measured by us. ## Questions **Where does this come from?** A public post credited to u/Former-Economy404. Source: https://www.reddit.com/r/mcp/comments/1xikqwl/anyone_enforcing_policy_across_a_whole_session/ **Is it free?** Yes. Feed entries are free to read and download. ## How to get it Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/check-the-whole-mcp-session-not-just-each-tool-call-for-the-untrusted-input-plus-private-data-plus-outbound-mix/, no signup. Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com