Aiagents

A revoked Claude Code permission is blocked when the MCP gateway compares a cached allow decision with the current policy version and revocation epoch

Claude Code lost permission. The MCP cache still said allow

Revoking Claude Code access is useless if an MCP gateway keeps serving an old allow decision. Bind cached authorization to policy version, resource state, and a short expiry.

An approved Claude Code MCP call is stopped when a redirect changes the destination, then allowed only after scheme, host, port, TLS identity, and resolved network range match the transport binding

Claude Code approved one MCP server. The request went somewhere else.

An MCP approval can bind to a tool name while DNS, redirects, proxies, and service discovery send the request elsewhere. Pin the transport identity at dispatch time.

A Claude Code call to an MCP method labelled read only fans out into a paid warehouse query, stored export, webhook, and audit-state change before an effect contract gates the call

Claude Code called a read-only MCP tool 186 times. The bill said otherwise.

An MCP method labelled read only can still start paid queries, create exports, send webhooks, and change audit state. Control the effects, not the method name.

Claude Code receives the first 100 of 8,742 records, follows every cursor against one snapshot, and produces a collection completeness receipt

Claude Code checked the first page and called the job done

An MCP tool returned 100 clean records, so Claude Code declared a migration complete. The other 8,642 records were still waiting behind a cursor.

A secret enters a Claude Code run, a data boundary replaces it with a safe reference, and a propagation receipt verifies every downstream surface

Claude Code redacted the secret after it had already spread

Redacting Claude Code’s final answer does not remove a secret from tool logs, traces, caches, and review packets. Track sensitive data through the whole run with a propagation receipt.

A Claude Code run completes while a cleanup gate revokes a temporary cloud role, token, and MCP session before handoff

Claude Code finished. Its temporary cloud access did not

A completed Claude Code run can leave cloud roles, tokens, and MCP sessions behind. Require a cleanup receipt that proves temporary authority has gone.

A timed-out Claude Code MCP request leaves a paid remote job running while a guarded retry looks up the operation and attaches to the existing job

Claude Code timed out, retried, and paid twice

A timed-out MCP call may still be running and charging your account. Give paid tool operations a stable ID, a spend ceiling, and a retry receipt before Claude Code tries again.

A Claude Code patch enters an independent evidence review before the agent explanation is revealed in a second pass

Do not let Claude Code explain its patch to the evaluator first

A polished Claude Code handoff can anchor the reviewer before the evidence is checked. Give an independent evaluator the task contract, patch, and raw test results first, then reveal the agent’s explanation.

A Claude Code trace with a missing MCP tool event is blocked by a completeness gate before replay and review

Make Claude Code prove its trace is complete before replay

A clean replay can be dangerously reassuring when the original trace dropped the tool call that changed production. Add sequence checks, expected-event accounting, and a completeness receipt before review.

Claude Code compacts its conversation while an external control-state checkpoint preserves authority, denied actions, pending effects, and evidence bindings

Keep Claude Code's safety state outside its context window

Context compaction can preserve the task while losing the decision that blocked a dangerous tool call. Store authority, denials, and unresolved effects in a control checkpoint outside the transcript.