MCP client with host-enforced tool risk: a connector that says it is read-only is making a claim, not a guarantee

The useful part of AI at work is never the chat window. It is the moment the assistant touches something real: the document service, the browser, the calendar, the system your business runs on.

Every one of those connections is somebody else’s code running with your access. The industry’s usual answer is a switch labelled read-only. The thing reporting that it is read-only is the connector itself.

The standard is open. The trust decision shouldn’t be handed off.

MCP is the open standard for those connections. A tool exposes itself once, and any assistant that speaks the protocol can use it. That is the right shape, because no single vendor sits between you and your own systems. A new revision of the standard shipped on 28 July 2026. FCT shipped its own client and host layer for it the following day.

Owning that layer is the whole point. Hosted connectors run on the vendor’s servers under the vendor’s rules and move when the vendor moves. Ours runs inside the operating layer we own, so the decision about what a connected tool may do belongs to you, not to the platform.

The speed was preparation. We had written the build plan five weeks before the standard landed, and most of what we guessed about its shape held. One section, the part about how a tool proves who it is, was wrong enough that we threw it away and rebuilt it from the standard itself. Both halves are worth saying, because a company that only reports the half it got right is not telling you anything.

Three rules carry the boundary

The host classifies every tool itself. A tool is callable only when its exact name has been written into a policy file by hand. Everything else is quarantined: never registered, never callable, surfaced for a person to look at.

A tool may never lower its own risk. Its self-reported read-only label is kept for the audit record and carries no authority. A tool that says it is read-only is making a claim, and an update upstream can change that claim silently.

Exact names, no wildcards. A rule like “anything starting with Get is a read” hands a server the ability to mint safe-looking tools by naming them well.

A changed contract goes back to quarantine. The classification was a judgment about a specific contract. When the contract moves, the judgment no longer applies.

Three smaller decisions sit underneath. A connected tool is handed the bare minimum it needs and never the keys to everything else on the machine, because it is somebody else’s code running as you. A read that fails may be tried again. Anything that changes something is never retried on its own, because a dropped connection cannot tell you whether the thing happened. And switching a tool off shuts it down, rather than hiding it behind a toggle while it keeps running.

Why this is the part to own

Connecting AI to your real systems is where the value is, and it is where every real risk lives. The model is rentable and replaceable. The layer deciding what that model may touch should not be.

That is the position behind Second Brain OS and the runtime under it: rent the model, own the brain and the boundary. On 29 July 2026 it stopped being a position and became code we run on.

Precise status, as always: this is live in FCT’s own operating layer with servers configured and running. The client-facing form is part of Second Brain OS, which is in testing and not generally available.