Mcp | Thomas Talks AI: Claude Architecture, AI Agent Security, Claude Code & Production Engineering

A timed-out Claude Code MCP write enters an unknown state, checks an operation journal, and either verifies the existing effect or retries with the same idempotency key

Treat a timed-out MCP write as an unknown outcome

A timed-out MCP write may have failed, succeeded, or finished after the client gave up. Use an operation journal and effect lookup before Claude Code retries it.

A Claude Code run pins an MCP capability manifest and stops when the live server schema, implementation, target scope, or side effects differ

Pin the MCP tool contract before Claude Code uses it

An MCP method can keep the same name while its schema, target scope, or side effects change. Pin a capability manifest so Claude Code cannot inherit a different tool after approval.

A Claude Code cost envelope that prices tool calls before execution, reserves budget at dispatch, records actual spend, and stops over-budget paths

Make Claude Code price the tool path before it starts

Token limits miss the expensive part of many Claude Code runs. A cost envelope prices search, MCP calls, evals, and retries before the agent can spend them.

A Claude Code evidence-linked trace connecting an observed failing deployment to a scoped plan, an authorised MCP tool call, the resulting effect, and a review decision

Make Claude Code cite the evidence behind every tool call

A tool-call log shows what Claude Code did. An evidence-linked trace shows which observation caused each action, which policy allowed it, and when the chain broke.

A Claude Code MCP permission delta showing one intended staging index allowed while production access, destructive DDL, another database, and role changes remain denied

Test the permission delta before widening Claude Code MCP access

A broader MCP grant may unblock one Claude Code task while authorizing unrelated production actions. Test what became possible and what must remain forbidden.

A Claude Code rollback rehearsal verifies a recovery target, restores an isolated environment, checks all external effects, and proves old code can read new data

Make Claude Code rehearse rollback before production approval

A rollback note says recovery should work. A rollback rehearsal checks the exact target, non-code state, data compatibility, recovery time, and service behaviour before approval.

A Claude Code denial-path eval blocks a plausible production database write because the run has read-only permission

Test the Claude Code tool call that must be refused

Happy-path evals show whether Claude Code can use a tool. A denial-path fixture proves whether it refuses a plausible request that exceeds its approved authority.

Stop Claude Code before an irreversible tool call

Claude Code can revert a patch, but Git cannot restore every MCP or production effect. Add an irreversibility gate before destructive tool calls run.

Two passing Claude Code test commands point to different commit, working tree, and lockfile fingerprints, so the review marks one result stale and requests a rerun

Bind Claude Code test results to the code they actually tested

Claude Code can report passing tests from different repository states. Add a run fingerprint so each result names the exact code, dependencies, tools, and policy it tested.

An approved effect contract and a Claude Code MCP write enter a receipt gate that checks the principal, target, state change, and independent verification before completion

Require an effect receipt after every Claude Code MCP write

An MCP tool can return success after changing the wrong target or using the wrong authority. Make Claude Code prove the external effect before it reports completion.