A tool server that says it's read-only is making a claim, not a guarantee

The useful part of AI at work is never the chat window. It is the moment the assistant touches something real: the document service, the browser, the calendar, the system the business actually runs on.

Every one of those connections is third-party code running with your access. The industry’s usual answer is a switch labelled read-only, and the thing reporting that it is read-only is the connector itself.

The standard is open. The trust decision shouldn’t be delegated.

MCP is the open standard for those connections. A tool exposes itself once, and any assistant that speaks the protocol can use it, which is the right shape: it means no single vendor sits between a business and its own systems. A new revision of the specification shipped on 28 July 2026. FCT shipped its own client and host layer for it the following day.

Owning that layer is the whole point. Hosted connectors run on the vendor’s backend under the vendor’s rules and move when the vendor moves. Ours runs inside the operating layer we own, which means the decision about what a connected tool is allowed to do belongs to the operator, not to the platform.

Some of that speed was preparation rather than heroics. The build plan for this client was written on 18 June, five weeks before the specification landed, and six of its six architectural predictions held: no handshake, no protocol session, server-minted handles passed as ordinary arguments, cacheable inventories, request-scoped input, first-class extensions. The section on authorization was wrong, missed a whole track of the standard, and had to be rebuilt from the specification text. Both halves of that are worth stating, because a company that only reports the half it got right is not telling you anything.

Three rules carry the boundary

The host classifies every tool itself, and a tool is callable only when its exact name has been written into a policy file by hand. Everything else is quarantined: never registered, never callable, surfaced for a person to look at.

A server may never lower its own risk. A tool’s self-reported read-only annotation is captured for the audit record and carries no authority. A server that says it is read-only is making a claim, and an upstream update can change that claim silently.

Exact names, no wildcards. A rule like “anything starting with Get is a read” hands an upstream server the ability to mint safe-looking tools by naming them well.

A schema change re-quarantines. The classification was a judgement about a specific contract. When the contract moves, the judgement no longer applies to it.

Three smaller decisions sit underneath. A connected server receives seven environment variables plus whatever it is explicitly granted, never the daemon’s own environment, because a local tool server is third-party code running as you. A failed read may be retried once; anything that can change the world is never retried automatically, because a transport failure cannot tell you whether the call never executed or executed and lost its answer. And a server switched off is disconnected, not filtered: its process is reclaimed rather than left running behind a hidden toggle.

Why this is the part to own

Connecting AI to a business’s real systems is where the value is, and it is also where every genuine risk lives. The model is rentable and replaceable. The layer deciding what that model may touch should not be.

That is the same position behind everything FCT ships: the model can be rented, the brain and the boundary should be owned. On 29 July 2026 it stopped being a position and became code we run on.

Precise status, as always: this is live in FCT’s own operating layer with servers configured and running. The client-facing form is part of Second Brain OS, which is in testing and not generally available.