| paths |
|
|---|
- Keep MCP tool names stable and descriptive.
- Keep destructive operations behind explicit guardrails.
- Route all logs to stderr only; never write protocol logs to stdout.
- Keep tool input schemas strict and bounded.
- Preserve loopback-only API target enforcement unless security posture changes by request.
- Verify MCP with
npm run mcp:typecheckandnpm run mcp:buildafter code edits.