The outcome

Gain retrieval and tool use without granting arbitrary packages or models access to the device and private files.

Step by step

A workflow you can repeat.

  1. 01

    Define approved files, embedding provider, knowledge scope, MCP use case, package source, filesystem and network permissions, secrets, side effects, approvals, retention, and removal plan.

  2. 02

    Create a minimal knowledge base from copies of approved documents, remove secrets and metadata, record owner and expiry, and verify whether embedding stays local or is sent remotely.

  3. 03

    Review each MCP package, version and dependency, prefer built-ins or pinned trusted sources, set the smallest workspace root and environment variables, and deny shell or broad filesystem access.

  4. 04

    Require interactive approval, inspect every proposed tool and argument, and test prompt injection, path traversal, symlinks, data exfiltration, untrusted URLs, malicious documents, duplicate actions, and denial.

  5. 05

    Use call-chain traces to audit models, retrieval and tools, revoke exposed keys, update only after review, and remove obsolete MCP binaries, memory files, knowledge indexes, caches, and backups.

Working standard

What good use looks like.

  • Use the smallest filesystem root.
  • Pin and inspect MCP packages.
  • Approve every consequential tool call.

Official references

Check the current product documentation.