# MCP Isolation

What to keep in mind about isolation when connecting external MCP servers.

MCP servers are third-party processes whose behavior is unverifiable. Agenvoy treats them as untrusted by default and does not provide a per-server "trusted" flag. All MCP tool calls go through the same confirm gate as built-in tools. For batch operation, mark specific tools auto-approve through `/mcp` → permission (or `POST /v1/allowlist` with a `tool` block) rather than trusting a whole server.

***

> [!NOTE]
> This document was auto-generated by Claude after reading the full source code.