A coding agent that's both an MCP client and server — and treats write-capable MCP tools as a distinct trust boundary

[ilyaosovskoi]

Pre-submission Checklist

• This post follows the MCP community guidelines

What would you like to share?

Sharing Tera Pilot, a self-hosted coding agent, because it sits on both sides of MCP and I'd like feedback from people who actually design MCP servers/clients for a living.

As a client: it discovers and calls external MCP tools inside its normal ReAct loop (plan → explore → act → verify), alongside its native file/git/execute tools.

As a server: it exposes its own tools (read_file, str_replace, execute_command, git ops, etc.) over ACP/MCP so other agents/editors can drive it:

tera-pilot-acp --mcp-server --workspace /path/to/project # read-only tools
tera-pilot-acp --mcp-server --workspace /path/to/project --allow-writes # opt-in writes

The design choice I'd like feedback on: read vs. write is an explicit, separate opt-in, not a capability the calling agent just gets by connecting. Externally-supplied write-capable MCP tools go through the same autonomy/confirmation gates (always_ask / new_files_only / never_ask) as the agent's own file-writing tools — a connected MCP server doesn't get to silently bypass the sandbox just because it announced a tool schema. Headless (daemon/ACP, no UI) runs fail closed on any side-effecting call unless explicitly opted into via --no-confirm.

This came out of thinking about MCP the way most threat models treat it: the protocol lets you discover and call tools trivially, but it doesn't itself say anything about how much you should trust a tool just because it's reachable. A write-capable MCP server from a third party is, in practice, the same class of risk as arbitrary code execution.

Repo, with the ACP/MCP section and the full autonomy model: https://github.com/ilyaosovskoi/tera-pilot (see THREAT_MODEL.md for how this is scoped).

Genuinely curious how others here are drawing this line for write-capable MCP tools in their own clients — allowlisting by server identity? per-tool capability declarations? something else? If you try wiring an external MCP server into it (or exposing it to another agent), I'd love to hear where it breaks — and a star if it's useful to you.

Relevant Links

• https://github.com/ilyaosovskoi/tera-pilot