Check the whole MCP session, not just each tool call, for the untrusted input plus private data plus outbound mix
by PaperChaseWebb
A post on r/mcp argues that per-call guardrails miss leaks made of two allowed calls, citing the case where a support ticket told an agent with a service role key to read a tokens table and post it back to the ticket. The fix is to break the combination of untrusted input, private data and an outbound channel per session.
- Price
- Free
- Difficulty
- Advanced
- Setup
- 1 hr
- Format
- .md file
check-the-whole-mcp-session-not-just-each-tool-call-for-the-untrusted-input-plus-private-data-plus-outbound-mix.md · 3 KB · direct download, no signup
What you end up with
A generic SQL tool cannot be policed per call, because one query looks like another to the rule.
What you get
- A plain-language summary of the workflow
- A fill-in prompt template
- What to watch out for
- A link to the original source
Who it is for
Builders who already use AI agents and want a proven workflow they can copy into their own project.
Works with
Dashed chip: Plain Markdown, so it also pastes into other agents such as Grok Bot, Hermes, OpenClaw or Muse. We list those as compatible by format only, not as tested.
Tools needed
Cost to run: Free with the agent plan you already use.
Time to result: One working session
How it works
List for each agent session: does it see untrusted text, private data,
List for each agent session: does it see untrusted text, private data, and can it send anything out?
Expected: Done before you move to the next step.
If all three are true, remove one: read-only, no outbound, or a fresh
If all three are true, remove one: read-only, no outbound, or a fresh session after untrusted input.
Expected: Done before you move to the next step.
Never give the agent an admin or service role key; use scoped tokens
Never give the agent an admin or service role key; use scoped tokens.
Expected: Done before you move to the next step.
Put a human approval in front of anything leaving the organisation
Put a human approval in front of anything leaving the organisation.
Expected: Done before you move to the next step.
Test with an instruction hidden inside a ticket or document
Test with an instruction hidden inside a ticket or document.
Expected: Done before you move to the next step.
Sample prompt from the pack
Apply this workflow to [your project]: 1. List for each agent session: does it see untrusted text, private data, and can it send anything out? 2. If all three are true, remove one: read-only, no outbound, or a fresh session after untrusted input. 3. Never give the agent an admin or service role key; use scoped tokens. 4. Put a human approval in front of anything leaving the organisation. 5. Test with an instruction hidden inside a ticket or document. Stop and ask me before anything irreversible: deploys, payments, sends or deletes.
Adapted by PaperChaseWebb. Not the original author's prompt.
Free preview of the file
# Check the whole MCP session, not just each tool call, for the untrusted input plus private data plus outbound mix PaperChase agent use case (free feed entry), version 1.0. Source: [u/Former-Economy404](https://www.reddit.com/r/mcp/comments/1xikqwl/anyone_enforcing_policy_across_a_whole_session/), 2026-10-29. ## What they did Reading a table was allowed and replying to a ticket was allowed, yet together they sent secrets to whoever could read the ticket. The author's list: a human before anything leaves the organisation, never run the agent with a key that skips row-level security, read-only mode where possible, a fresh session when the trust level changes, and narrow outbound access. A separate thread about agents in Cloudflare reaches the same conclusion: prompts ask an agent to behave, scoped tokens actually limit it. ## Worth knowing A generic SQL tool cannot be policed per call, because one query looks like another to the rule. Decide per session which of the three ingredients the agent gets, and drop one.
Worth knowing
- A generic SQL tool cannot be policed per call, because one query looks like another to the rule. Decide per session which of the three ingredients the agent gets, and drop one.
- Figures are as reported by the original author and were not re-measured by us.
Questions
Where does this come from?
A public post credited to u/Former-Economy404. Source: https://www.reddit.com/r/mcp/comments/1xikqwl/anyone_enforcing_policy_across_a_whole_session/
Is it free?
Yes. Feed entries are free to read and download.
Details
Version 1.0 · Updated Oct 29, 2026 · Markdown version of this page
License: Personal and commercial use. Credit the original source when you share the workflow. Download terms
Related
AGENTS.md, CLAUDE.md and Cursor rules starter files
Six fill-in instruction files for coding agents (base, Next.js plus Supabase, FastAPI, browser game, CLAUDE.md pointer, scoped Cursor rules), an Approvals section that makes the agent stop and wait for your yes, a table of what Grok Bot, Claude Code, Codex, Hermes and Cursor each read, a read-only checker for your rule files and 9 prompts to write, trim and test your own.
Ask-first rules for AI agents: hard nos, approval cards and a test set
Paste-in rules that make an agent ask before it sends, spends, posts or deletes, define what a real yes is, and stop retries after a no, plus 12 test scenarios to check it.