Dev details how to let an MCP agent delete files safely: HMAC preview tokens and deny lists
qupit · reddit · 2026-10-20
The developer of Bytewell, a Mac disk cleaner with an MCP server, explains the safety design behind letting agents run movetotrash and uninstallapp:
- Trash-only moves, journaled with an undotrash tool — worst case is annoying, not destructive.
- Suggestion whitelist: agents can only pass paths returned by listcleanupsuggestions.
- Two-step calls with signed preview tokens: a confirm requires an HMAC-SHA256 token under 10 minutes old, matching tool and unchanged path list.
- Code-level deny list (Keychains, SSH/GPG keys, .env, .pem, etc.), re-resolved via realpath right before each move to block symlink and case tricks.
- Helper tools don't inherit Full Disk Access.
Honest weak spot: the token proves a preview matched the confirm, not that a human read it — currently covered by client-side tool approval.
More from coding & agent
- SlideOn lands in sentence-transformers with one-line SparseEncoder loading — tomaarsen · 2026-10-20
- Do UIs still matter when AI agents become the main consumers of your data? — DanielLockyer · 2026-10-20
- Tiny MMO where a fruit fly is the player, built in Cursor with a 10M-token context agent model — Kyrannio · 2026-10-20
- Deep Research took 682 minutes and 54 corrections for one question: is it broken? — big-fox- · 2026-10-20
- Running sales with 83 MCP tools entirely inside Claude CLI — Extension-Lie-8715 · 2026-10-20
- AWS AgentCore Gateway Policy Only Gates MCP Tools, Leaves resources/read Always Allowed — rahulladumor · 2026-10-20