MCP | Thomas Talks AI

Constructed audiences checked against https://pay.example/mcp. The exact value is allowed. A different server and a longer path are denied. A token naming two servers passes membership and fails a single-audience policy.

Azure AD Graph accepted a token issued for a different tenant

Dirk-jan Mollema changed the tenant on an impersonation token whose signed Actor token named his lab. Azure AD Graph accepted it. CVE-2025-55241 followed. The MCP lesson is an exact audience check on constructed claims.

Follow every inventory page, require completion evidence, then release the planning input. Stop on a timeout, cursor loop or missing evidence.

Claude Code read one page and planned for the whole inventory

A successful MCP read can still be incomplete. Require pagination and snapshot evidence before an agent uses missing items to justify a change.

Worker A holds epoch 41 and pauses. The authority grants epoch 42 to worker B. The resource accepts B and rejects the resumed worker A.

Claude Code restarted. Its old MCP worker kept writing.

A replacement worker does not silence the old one. Fence stale MCP writes at the resource boundary before a resumed job overwrites newer work.

A review packet has passing tests but a missing MCP write receipt. Further agent writes are blocked while an authorised operator reconciles the outcome.

Claude Code review packets: unknown is not a pass

Passing tests cannot settle a missing MCP write receipt. Give unresolved effects a status that the approval gate cannot ignore.

An agent writes revision 41, an engineer writes revision 42, and conditional recovery refuses to overwrite the engineer's repair

Claude Code rollback must not erase the next engineer's fix

A saved snapshot can undo the agent’s change and somebody else’s repair. Make recovery conditional on the revision the agent wrote.

One Claude Code MCP call fans out to paid workers while a shared cost capability blocks work beyond the 25 dollar limit

One Claude Code MCP call spent the whole agent budget

The Claude Code run had a $25 limit and made one MCP call. Hidden fan-out behind the server produced a $286.40 bill.

A Claude Code incident replay forks into a faithful path using captured MCP evidence and a misleading path that calls today's live tools

Your Claude Code incident replay used today's tool output

The same prompt and repository commit produced a clean replay because an MCP tool returned newer evidence. The team had rerun the task, not reproduced the incident.

Claude Code plans against resource version 41, but a state-bound write gate blocks execution after the resource changes to version 42

Claude Code approved one state. Its MCP write changed another

A reviewer approved a Claude Code change against resource version 41. By execution time, version 42 existed, but the MCP write replaced it anyway.

An allowed Claude Code CI retry passes through build and release systems before a fresh capability gate blocks production deployment

Claude Code had no deploy permission. Its MCP tool deployed anyway

A permitted CI retry reached production through an artifact event and a more powerful release service. Tool permissions missed the effect that mattered.

Claude Code's audit trail put the effect before the approval

Clock skew made an approved Claude Code run look unauthorized. Wall-clock timestamps cannot prove the order of a production agent’s approval, dispatch, commit, and revocation.