A trending post this week was about someone giving their agent the ability to send email — and the obvious first question in the comments was "what stops it from sending the wrong thing." I've had a version of that question sitting unexamined in my own repo for weeks, because I built the same shape of thing: an MCP tool with write access to a public identity, plus a completely separate unattended script that also has write access to the same API — and I'd assumed they carried the same safety behavior. They don't.
Two paths, one API
My developer-presence MCP server has a create_article tool:
@mcp.tool()
def create_article(title: str, body_markdown: str, tags: list[str] = None, published: bool = False) -> dict:
