MCP users debate field-level redaction instead of all-or-nothing tool access
Sad_Cover9067 · reddit · 2026-07-24
An MCP output could be sanitized field-by-field instead of fully allowed or blocked
The post raises a permission-fatigue problem in agent workflows: after enough prompts, the user may stop making meaningful security decisions and just click Allow.
The author suggests a middle ground for MCP tools. If a tool returns:
json
{
"accountid": "12345",
"subscription": "pro",
"passportnumber": "AB1234567"
}
the agent may only need the account ID and subscription status. Instead of forcing a binary choice—either expose everything or block the whole response—the tool could preserve structure while replacing sensitive fields locally:
json
{
"accountid": "12345",
"subscription": "pro",
"passportnumber": "{{SEALED1}}"
}
The idea is that the model can keep working with the redacted response, while the real value stays local and could be restored later by the user.
The author says they are experimenting with this in a local tool, but they are unsure where the control should live:
- inside the MCP server,
- in the client,
- or in a proxy layer between them.
They also worry that mutating tool output may introduce ambiguity for the agent.
More from coding & agent
- SGLang talk says RL post-training is really an inference problem — BanghuaZ · 2026-07-24
- Claude’s code-comment narration looks like the same failure mode as Bash-comment reasoning — mertdumenci · 2026-07-24
- Engineer says U.S. models block harmless security tests, forcing a switch to Chinese AI — kristoph · 2026-07-24
- Agent platform builders debate whether custom prompts belong in system or user messages — Final-Choice8412 · 2026-07-24
- rem-exec wraps SSH commands in JSON for agent-friendly remote operations — nivosnation · 2026-07-24
- Can an MCP tool help AI compare photos with CAD drawings and flag mismatches? — Special_Spring4602 · 2026-07-24