Repository navigation
fix(setup): keep draft creation and mailbox search behind a prompt - #2020
Merged
Merged
Conversation
potiuk
enabled auto-merge (squash)
November 7, 2026 00:19
github-actions
Bot
added
family:setup
The derived MCP allows covered create_draft and the two whole-mailbox searches. Take them out of the registry, the framework settings and the recommended lists, so these calls reach the operator as a prompt. Generated-by: Claude Opus 5
potiuk
force-pushed
the
mcp-allows-prompt
branch
from
November 7, 2026 00:25
e26463f to
f7b0166
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three MCP tools were on the derived allow list, so they ran with no prompt:
mcp__gmail-plaintext__create_draftmcp__claude_ai_Gmail__search_threadsmcp__ponymail__search_listThese sessions read untrusted content, so the operator should see a draft being created or a whole mailbox being searched.
This takes the three out of
family-mcp-allows.json, the framework's.claude/settings.json, the recommended lists inpermission-auditandverify.md, and the setup docs.Reading a named thread or message stays allowed.
The registry comment now states the rule: list only tools that read one named item or report state.
Cost to adopters: each draft and each mailbox or list search now prompts.
security-issue-syncandsecurity-issue-importsearch often, so a bulk run prompts noticeably more.Adopters can add the entries back in their own settings.
Type of change
Test plan
prek run --from-ref <base> --to-ref HEAD --skip workspace-pytestpassestools/permission-auditandtools/sandbox-linttests passtools/dev/check-family-plugins.pypassesGen-AI disclosure
Drafted with Claude Code and reviewed by the maintainer.
🤖 Generated with Claude Code