{"verified":"2026-10-22","mcpSpec":{"version":"2026-07-28","url":"https://modelcontextprotocol.io/docs/2026-07-28/learn/versioning"},"count":11,"note":"null = not documented in the official docs we checked (not necessarily unsupported). Paths starting with ~ are relative to the user home directory. Bilingual fields: {zh, en}.","pages":{"en":"https://aimap.page/en/for-ai/agents/","zh-hans":"https://aimap.page/zh-hans/for-ai/agents/"},"clients":[{"id":"claude-code","sw":"claude-code","name":"Claude Code","vendor":"Anthropic","forms":["CLI","IDE","Desktop","Web"],"status":null,"mcp":{"add":"claude mcp add --transport http <name> <url>","files":["~/.claude.json (local / user scope)",".mcp.json (project scope, shared)"],"transports":["stdio","HTTP","SSE (deprecated)","WebSocket"],"oauth":true,"note":{"zh":"项目里的 .mcp.json 首次使用前要你确认；用 /mcp 查看状态和登录 OAuth","en":"Project .mcp.json servers need your approval before first use; /mcp shows status and runs OAuth"}},"rules":["CLAUDE.md / .claude/CLAUDE.md","CLAUDE.local.md","~/.claude/CLAUDE.md",".claude/rules/","AGENTS.md (read when present)"],"skills":[".claude/skills/<name>/SKILL.md","~/.claude/skills/"],"extras":{"hooks":true,"subagents":true,"plugins":true},"permissions":{"zh":"权限模式：default（逐个确认）/ acceptEdits / plan / auto（分类器审核）/ dontAsk / bypassPermissions","en":"Permission modes: default (ask per tool) / acceptEdits / plan / auto (classifier review) / dontAsk / bypassPermissions"},"sandbox":{"zh":"/sandbox 开启，默认关闭；macOS 用 Seatbelt，Linux / WSL2 用 bubblewrap，原生 Windows 不支持","en":"Turn on with /sandbox (off by default); Seatbelt on macOS, bubblewrap on Linux / WSL2, not on native Windows"},"docs":[{"l":"MCP","u":"https://code.claude.com/docs/en/mcp"},{"l":"CLAUDE.md / AGENTS.md","u":"https://code.claude.com/docs/en/memory"},{"l":"Skills","u":"https://code.claude.com/docs/en/skills"},{"l":"Permissions","u":"https://code.claude.com/docs/en/permissions"},{"l":"Sandbox","u":"https://code.claude.com/docs/en/sandboxing"}],"record":"https://aimap.page/api/v1/software/claude-code.json"},{"id":"codex","sw":"codex","name":"Codex (CLI · IDE · ChatGPT desktop)","vendor":"OpenAI","forms":["CLI","IDE","Desktop"],"status":null,"mcp":{"add":"codex mcp add <name> -- <command>","files":["~/.codex/config.toml → [mcp_servers.<name>]",".codex/config.toml (trusted projects only)"],"transports":["stdio","Streamable HTTP"],"oauth":true,"note":{"zh":"CLI、IDE 插件和 ChatGPT 桌面端共用同一份配置；可按服务器设工具白名单和审批方式","en":"CLI, IDE extension and ChatGPT desktop share one config; per-server tool allow-lists and approval modes"}},"rules":["AGENTS.md (repo root → cwd)","AGENTS.override.md","~/.codex/AGENTS.md"],"skills":[".agents/skills/ (cwd → repo root)","~/.agents/skills/","/etc/codex/skills"],"extras":{"hooks":true,"subagents":true,"plugins":true},"permissions":{"zh":"沙箱 read-only / workspace-write（默认，网络关）/ danger-full-access；审批 on-request / never / granular","en":"Sandbox read-only / workspace-write (default, network off) / danger-full-access; approvals on-request / never / granular"},"sandbox":{"zh":"默认开启：macOS 用 Seatbelt，Linux 用 bwrap + seccomp，Windows 用 MXC；.git、.codex、.agents 等目录始终只读","en":"On by default: Seatbelt on macOS, bwrap + seccomp on Linux, MXC on Windows; .git, .codex, .agents stay read-only"},"docs":[{"l":"MCP","u":"https://learn.chatgpt.com/docs/extend/mcp?surface=cli"},{"l":"AGENTS.md","u":"https://learn.chatgpt.com/docs/agent-configuration/agents-md"},{"l":"Skills","u":"https://learn.chatgpt.com/docs/build-skills"},{"l":"Approvals & security","u":"https://learn.chatgpt.com/docs/agent-approvals-security"}],"record":"https://aimap.page/api/v1/software/codex.json"},{"id":"cursor","sw":"cursor","name":"Cursor (editor · CLI)","vendor":"Anysphere","forms":["IDE","CLI"],"status":null,"mcp":{"add":null,"files":[".cursor/mcp.json (project)","~/.cursor/mcp.json (global)"],"transports":["stdio","SSE","Streamable HTTP"],"oauth":true,"note":{"zh":"也可在 Customize 页从 Cursor Marketplace 一键安装；每次 MCP 调用默认都要确认，可设 MCP 白名单","en":"Or one-click install from the Cursor Marketplace in Customize; each MCP call needs approval unless allow-listed"}},"rules":[".cursor/rules/*.mdc","AGENTS.md","User Rules / Team Rules (settings)"],"skills":[".agents/skills/",".cursor/skills/","~/.agents/skills/","~/.cursor/skills/",".claude/skills/ · .codex/skills/ (compat)"],"extras":{"hooks":true,"subagents":true,"plugins":true},"permissions":{"zh":"Run Modes：Auto-review（推荐，分类器审核）/ Allowlist / Run Everything（全部自动执行）","en":"Run Modes: Auto-review (recommended, classifier) / Allowlist / Run Everything (no checks)"},"sandbox":{"zh":"终端命令可在沙箱里跑（Auto-review 或 Allowlist + 沙箱）；CLI 用 /sandbox 或 --sandbox 切换。官方说明 Auto-review 不是安全边界","en":"Shell commands can run sandboxed (Auto-review, or Allowlist with sandbox); CLI uses /sandbox or --sandbox. Cursor says Auto-review is not a security boundary"},"docs":[{"l":"MCP","u":"https://cursor.com/docs/mcp"},{"l":"Rules","u":"https://cursor.com/docs/rules"},{"l":"Skills","u":"https://cursor.com/docs/skills"},{"l":"Run Modes","u":"https://cursor.com/docs/agent/security/run-modes"},{"l":"CLI","u":"https://cursor.com/docs/cli/overview"}],"record":"https://aimap.page/api/v1/software/cursor.json"},{"id":"github-copilot","sw":"github-copilot","alt":"copilot-cli","name":"GitHub Copilot (VS Code · Copilot CLI)","vendor":"GitHub","forms":["IDE","CLI","Cloud"],"status":null,"mcp":{"add":"copilot mcp add  ·  /mcp add","files":[".vscode/mcp.json (VS Code)","~/.copilot/mcp-config.json (CLI)",".mcp.json · .github/mcp.json (CLI, per repo)"],"transports":["stdio","HTTP"],"oauth":null,"note":{"zh":"Copilot CLI 自带 GitHub MCP 服务器；仓库里的 MCP 配置优先于用户配置","en":"Copilot CLI ships with GitHub’s MCP server; repo-level MCP config takes precedence over user config"}},"rules":[".github/copilot-instructions.md",".github/instructions/*.instructions.md","AGENTS.md","CLAUDE.md / GEMINI.md (repo root)"],"skills":[".github/skills/",".claude/skills/",".agents/skills/","~/.copilot/skills/","~/.agents/skills/"],"extras":{"hooks":null,"subagents":null,"plugins":null},"permissions":{"zh":"CLI 默认逐项确认；--allow-tool 精确放行，--allow-all-tools 等于把你的全部权限交给它","en":"CLI asks by default; --allow-tool grants specific tools, --allow-all-tools hands over all your access"},"sandbox":{"zh":"CLI 里 /sandbox enable 开本地沙箱；云端沙箱为公开预览","en":"/sandbox enable in the CLI for a local sandbox; cloud sandboxes are in public preview"},"docs":[{"l":"CLI MCP","u":"https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-mcp-servers"},{"l":"VS Code MCP","u":"https://code.visualstudio.com/docs/agent-customization/mcp-servers"},{"l":"Instructions","u":"https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions"},{"l":"Skills","u":"https://docs.github.com/en/copilot/concepts/customizations/agent-skills"},{"l":"Copilot CLI","u":"https://docs.github.com/en/copilot/concepts/copilot-surfaces/copilot-cli"}],"record":"https://aimap.page/api/v1/software/github-copilot.json"},{"id":"antigravity-cli","sw":"google-antigravity","name":"Antigravity CLI","vendor":"Google","forms":["CLI","Desktop"],"status":{"zh":"2026-05-19 发布，取代 Gemini CLI：2026-06-18 起 Gemini CLI 不再服务免费、Google AI Pro / Ultra 个人用户","en":"Launched 2026-05-19 as Gemini CLI’s successor; since 2026-06-18 Gemini CLI no longer serves free and Google AI Pro / Ultra individual users"},"mcp":{"add":null,"files":["~/.gemini/config/mcp_config.json (global)",".agents/mcp_config.json (workspace)"],"transports":["stdio","SSE","Streamable HTTP","WebSocket"],"oauth":null,"note":{"zh":"远程服务器必须写 serverUrl（旧的 url / httpUrl 不再支持）；/mcp 打开管理面板；安装时会自动迁移 Gemini CLI 的 MCP 和技能","en":"Remote servers must use serverUrl (url / httpUrl are not supported); /mcp opens the manager; install migrates Gemini CLI MCP servers and skills"}},"rules":["GEMINI.md","AGENTS.md","~/.gemini/GEMINI.md"],"skills":[".agents/skills/","~/.gemini/antigravity-cli/skills/"],"extras":{"hooks":true,"subagents":true,"plugins":true},"permissions":null,"sandbox":{"zh":"官方文档有“沙箱与文件访问控制”专页，细节见链接","en":"Has a dedicated sandbox / file-access page in the official docs"},"docs":[{"l":"MCP","u":"https://antigravity.google/docs/mcp"},{"l":"Skills","u":"https://antigravity.google/docs/skills"},{"l":"Migrate from Gemini CLI","u":"https://antigravity.google/docs/cli/gcli-migration/"},{"l":"Announcement","u":"https://developers.googleblog.com/en/an-important-update-transitioning-gemini-cli-to-antigravity-cli/"}],"record":"https://aimap.page/api/v1/software/google-antigravity.json"},{"id":"gemini-cli","sw":"gemini-cli","name":"Gemini CLI","vendor":"Google","forms":["CLI"],"status":{"zh":"仅企业（Gemini Code Assist 许可）和 API key 用户还能用；个人用户请换 Antigravity CLI","en":"Still served only for enterprise (Gemini Code Assist licences) and API-key users; individuals should move to Antigravity CLI"},"mcp":{"add":"gemini mcp add <name> <command|url>","files":["~/.gemini/settings.json → mcpServers",".gemini/settings.json (project, default scope)"],"transports":["stdio","SSE","Streamable HTTP"],"oauth":true,"note":{"zh":"trust: true 会跳过该服务器所有工具确认，只给你完全掌控的服务器用；启动 MCP 进程时默认清掉 *TOKEN* / *KEY* 等敏感环境变量","en":"trust: true skips every confirmation for that server—only for servers you fully control; sensitive env vars (*TOKEN*, *KEY*…) are stripped from MCP processes by default"}},"rules":["GEMINI.md (context.fileName configurable)","~/.gemini/GEMINI.md"],"skills":[".gemini/skills/ · .agents/skills/","~/.gemini/skills/ · ~/.agents/skills/"],"extras":{"hooks":true,"subagents":true,"plugins":true},"permissions":null,"sandbox":{"zh":"-s / GEMINI_SANDBOX 开启：docker、podman、macOS Seatbelt 等","en":"Enable with -s / GEMINI_SANDBOX: docker, podman, macOS Seatbelt and more"},"docs":[{"l":"MCP","u":"https://geminicli.com/docs/tools/mcp-server/"},{"l":"Transition notice","u":"https://developers.googleblog.com/en/an-important-update-transitioning-gemini-cli-to-antigravity-cli/"}],"record":"https://aimap.page/api/v1/software/gemini-cli.json"},{"id":"devin-desktop","sw":"windsurf","name":"Devin Desktop / Devin CLI (formerly Windsurf)","vendor":"Cognition","forms":["IDE","CLI","Cloud"],"status":{"zh":"Windsurf 于 2026-06-02 更名为 Devin Desktop；默认本地 agent 由 Cascade 换成 Devin Local（与 Devin CLI 共用配置）","en":"Windsurf became Devin Desktop on 2026-06-02; the default local agent moved from Cascade to Devin Local (shares Devin CLI config)"},"mcp":{"add":"devin mcp add <name> <url>","files":[".devin/mcp_config.local.json (local, default)",".devin/mcp_config.json (project)","~/.config/devin/mcp_config.json (user)"],"transports":["stdio","Streamable HTTP","SSE"],"oauth":true,"note":{"zh":"旧 Cascade agent 仍用自己的 mcp_config.json","en":"The legacy Cascade agent keeps its own mcp_config.json"}},"rules":["AGENTS.md","~/.config/devin/AGENTS.md",".devin/rules/ (legacy .windsurf/rules/)"],"skills":[".agents/skills/",".devin/skills/ (legacy .windsurf/skills/)","~/.agents/skills/","~/.config/devin/skills/"],"extras":{"hooks":true,"subagents":true,"plugins":true},"permissions":null,"sandbox":{"zh":"Devin CLI 有系统级沙箱（Linux 需 bubblewrap + socat），企业可强制开启","en":"Devin CLI has OS-level sandboxing (Linux needs bubblewrap + socat); enterprises can enforce it"},"docs":[{"l":"Devin CLI MCP","u":"https://docs.devin.ai/cli/extensibility/mcp/configuration"},{"l":"Rules & AGENTS.md","u":"https://docs.devin.ai/cli/extensibility/rules"},{"l":"Skills","u":"https://docs.devin.ai/cli/extensibility/skills/overview"},{"l":"Sandbox","u":"https://docs.devin.ai/cli/sandbox"},{"l":"Windsurf → Devin Desktop FAQ","u":"https://docs.devin.ai/desktop/devin-desktop-faq"}],"record":"https://aimap.page/api/v1/software/windsurf.json"},{"id":"cline","sw":"cline","name":"Cline","vendor":"Cline","forms":["IDE","CLI"],"status":null,"mcp":{"add":null,"files":["cline_mcp_settings.json (extension: MCP Servers → Configure)","~/.cline/data/settings/cline_mcp_settings.json (CLI)"],"transports":["stdio","Streamable HTTP (recommended)","SSE (legacy)"],"oauth":null,"note":null},"rules":[".clinerules/ · .cline/rules/","AGENTS.md · ~/.agents/AGENTS.md",".cursorrules · .windsurfrules (auto-detected)"],"skills":[".cline/skills/ · .clinerules/skills/",".claude/skills/","~/.cline/skills/"],"extras":{"hooks":null,"subagents":true,"plugins":null},"permissions":{"zh":"默认逐步确认，可按操作类型开启自动批准（Auto Approve）","en":"Asks step by step by default; Auto Approve can be enabled per action type"},"sandbox":null,"docs":[{"l":"MCP","u":"https://docs.cline.bot/mcp/mcp-overview"},{"l":"Rules","u":"https://docs.cline.bot/customization/cline-rules"},{"l":"Skills","u":"https://docs.cline.bot/customization/skills"}],"record":"https://aimap.page/api/v1/software/cline.json"},{"id":"opencode","sw":"opencode","name":"OpenCode","vendor":"Anomaly","forms":["CLI","IDE","Desktop"],"status":null,"mcp":{"add":null,"files":["opencode.json(c) → \"mcp\" (type: local | remote)"],"transports":["local (stdio)","remote (HTTP)"],"oauth":true,"note":null},"rules":["AGENTS.md","~/.config/opencode/AGENTS.md","CLAUDE.md · ~/.claude/CLAUDE.md (fallback)"],"skills":[".opencode/skills/","~/.config/opencode/skills/",".claude/skills/ · ~/.claude/skills/",".agents/skills/ · ~/.agents/skills/"],"extras":{"hooks":null,"subagents":true,"plugins":true},"permissions":{"zh":"每类操作设 allow / ask / deny，可按命令通配符细分","en":"allow / ask / deny per action, with wildcard rules per command"},"sandbox":null,"docs":[{"l":"MCP","u":"https://opencode.ai/docs/mcp-servers/"},{"l":"Rules","u":"https://opencode.ai/docs/rules/"},{"l":"Skills","u":"https://opencode.ai/docs/skills/"},{"l":"Permissions","u":"https://opencode.ai/docs/permissions/"}],"record":"https://aimap.page/api/v1/software/opencode.json"},{"id":"kiro","sw":"kiro","name":"Kiro (IDE · CLI)","vendor":"AWS","forms":["IDE","CLI","Web"],"status":null,"mcp":{"add":null,"files":[".kiro/settings/mcp.json (workspace)","~/.kiro/settings/mcp.json (user)"],"transports":["stdio","remote HTTPS"],"oauth":true,"note":null},"rules":[".kiro/steering/","~/.kiro/steering/","AGENTS.md"],"skills":[".kiro/skills/","~/.kiro/skills/"],"extras":{"hooks":true,"subagents":null,"plugins":null},"permissions":null,"sandbox":null,"docs":[{"l":"MCP","u":"https://kiro.dev/docs/mcp/configuration/"},{"l":"Steering","u":"https://kiro.dev/docs/steering/"},{"l":"Skills","u":"https://kiro.dev/docs/skills/"}],"record":"https://aimap.page/api/v1/software/kiro.json"},{"id":"qwen-code","sw":"qwen-code","name":"Qwen Code","vendor":"Alibaba Qwen","forms":["CLI"],"status":null,"mcp":{"add":"qwen mcp add --transport http <name> <url>","files":["~/.qwen/settings.json (user, default)",".qwen/settings.json (project)"],"transports":["stdio","Streamable HTTP","SSE"],"oauth":true,"note":null},"rules":["QWEN.md (context.fileName configurable)"],"skills":[".qwen/skills/","~/.qwen/skills/"],"extras":{"hooks":null,"subagents":null,"plugins":null},"permissions":{"zh":"审批模式 plan / default / auto-edit / auto（分类器）/ yolo","en":"Approval modes plan / default / auto-edit / auto (classifier) / yolo"},"sandbox":{"zh":"tools.sandbox 可设为 docker 等","en":"tools.sandbox can be set to docker and others"},"docs":[{"l":"MCP","u":"https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/"},{"l":"Skills","u":"https://qwenlm.github.io/qwen-code-docs/en/users/features/skills/"},{"l":"Settings","u":"https://qwenlm.github.io/qwen-code-docs/en/users/configuration/settings/"}],"record":"https://aimap.page/api/v1/software/qwen-code.json"}],"safety":{"verified":"2026-10-22","pages":{"en":"https://aimap.page/en/for-ai/safety/","zh-hans":"https://aimap.page/zh-hans/for-ai/safety/"},"sources":[{"l":"MCP · Security Best Practices","u":"https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices"},{"l":"MCP · Local Server Security","u":"https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/local-server-security"},{"l":"Claude Code · Sandboxing","u":"https://code.claude.com/docs/en/sandboxing"},{"l":"Codex · Agent approvals & security","u":"https://learn.chatgpt.com/docs/agent-approvals-security"},{"l":"Cursor · Run Modes","u":"https://cursor.com/docs/agent/security/run-modes"}],"risks":[{"id":"local","src":"https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/local-server-security","t":{"zh":"本地 MCP 服务器 = 以你的身份运行的程序","en":"A local MCP server runs as you"},"d":{"zh":"stdio 服务器是你电脑上的普通进程，能读你能读的文件、用你环境里的令牌、随意联网。一条 npx 命令装上的第三方服务器，权限和你本人一样。","en":"A stdio server is an ordinary process on your machine: it can read what you can read, use tokens in your environment and reach the network. A third-party server installed with one npx command has your full access."},"fix":{"zh":"不需要碰本机的服务改用远程版；第三方服务器放进容器、沙箱或虚拟机；固定版本号，只装能确认发布者的。","en":"Use the remote version when it needs nothing local; run third-party servers in a container, sandbox or VM; pin versions and install only from identifiable publishers."}},{"id":"injection","src":"https://code.claude.com/docs/en/mcp","t":{"zh":"工具返回的内容可能带“提示注入”","en":"Tool output can carry prompt injection"},"d":{"zh":"会抓网页、读邮件、读工单的服务器，会把外部写的文字原样交给模型；里面藏的指令可能让 agent 去做你没让它做的事。Anthropic、OpenAI 的官方文档都专门提醒了这一点。","en":"Servers that fetch pages, mail or tickets hand text written by outsiders straight to the model; hidden instructions can make the agent do things you never asked for. Anthropic’s and OpenAI’s official docs both warn about this."},"fix":{"zh":"读外部内容的工具和能写、能发、能付款的工具不要同时放开自动执行；敏感操作保留人工确认。","en":"Don’t auto-run tools that read outside content together with tools that write, send or pay; keep a human confirmation on sensitive actions."}},{"id":"definitions","src":"https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/local-server-security","t":{"zh":"工具描述本身也是不可信输入","en":"Tool definitions are untrusted input too"},"d":{"zh":"服务器给出的工具名称和描述会直接进模型上下文，描述可以被写成诱导模型的指令，也可能在你批准后悄悄改掉。","en":"Tool names and descriptions go straight into the model’s context; they can be written to steer the model, or change after you approved them."},"fix":{"zh":"装之前扫一眼每个工具的描述；用会在工具定义变化时重新提示的客户端；只开需要的工具（多数客户端支持工具白名单）。","en":"Skim each tool description before installing; prefer clients that re-prompt when a definition changes; enable only the tools you need (most clients support tool allow-lists)."}},{"id":"tokens","src":"https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices","t":{"zh":"令牌给得太宽、被转手","en":"Over-broad or passed-through tokens"},"d":{"zh":"官方安全指南点名的几类问题：令牌透传（服务器把收到的令牌原样转给下游 API）、混淆代理、权限范围过大。一个能读写所有仓库的令牌，一旦被注入利用，损失就是全部仓库。","en":"The official guide names token passthrough (forwarding a client’s token to downstream APIs), confused-deputy attacks and over-broad scopes. A token that can write every repo turns one injection into access to all of them."},"fix":{"zh":"每个服务器单独发最小权限令牌（细粒度 PAT、只读数据库账号）；OAuth 只申请需要的 scope；不要把 shell 里的全部环境变量继承给服务器。","en":"Give each server its own least-privilege credential (fine-grained PATs, read-only DB users); request only needed OAuth scopes; don’t let servers inherit your whole shell environment."}},{"id":"files-net","src":"https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/local-server-security","t":{"zh":"文件和网络不设边界","en":"No limits on files and network"},"d":{"zh":"能写任意目录、能连任意地址，就能删改代码库外的文件、把数据发出去（官方指南也提到 SSRF）。","en":"Write access everywhere plus open egress means files outside the project can be changed and data can leave (the guide also covers SSRF)."},"fix":{"zh":"文件访问限定到具体目录、能只读就只读；不需要网络的服务器关掉外连，其余只放行已知地址。agent 自己的命令也尽量在沙箱里跑。","en":"Limit file access to specific directories, read-only where possible; disable egress for servers that don’t need it and allow-list the rest. Run the agent’s own commands in a sandbox too."}},{"id":"autoapprove","src":"https://cursor.com/docs/agent/security/run-modes","t":{"zh":"“全自动”模式等于放弃最后一道闸","en":"“Run everything” removes the last gate"},"d":{"zh":"bypassPermissions、--allow-all-tools、Run Everything、danger-full-access、trust: true 这类开关会让 agent 不经确认执行任何命令。Cursor 官方也说明，自动审核分类器不是安全边界。","en":"Switches such as bypassPermissions, --allow-all-tools, Run Everything, danger-full-access or trust: true let the agent run anything without asking. Cursor itself notes its Auto-review classifier is not a security boundary."},"fix":{"zh":"只在一次性容器或虚拟机里用全自动；日常用“工作区可写 + 需要时再问”这类默认档。","en":"Use full auto only inside a throwaway container or VM; day to day, stay on defaults like “workspace-write + ask when needed”."}}],"checklist":{"personal":[{"zh":"清楚客户端里配置的每一个服务器，不用的删掉","en":"Know every server in your client config; remove the ones you don’t use"},{"zh":"不需要访问本机的服务器用远程版，不跑本地进程","en":"Servers that need nothing from your machine run remotely, not as local processes"},{"zh":"每个服务器都来自可识别的发布者，并固定版本","en":"Every server comes from an identifiable publisher, with its version pinned"},{"zh":"第三方服务器隔离运行（容器、沙箱或虚拟机），不直接裸跑","en":"Third-party servers run isolated (container, sandbox or VM), not as bare processes"},{"zh":"每个服务器通过单独配置拿到自己的最小权限凭据，不继承 shell 环境、不复用","en":"Each server gets its own narrowly scoped credentials via per-server config — nothing inherited from your shell, nothing reused"},{"zh":"文件访问限定到具体目录，能只读就只读","en":"Filesystem access is limited to specific directories, read-only where possible"},{"zh":"不需要网络的服务器禁止外连，其余只放行已知目的地","en":"Servers that don’t need the network run with egress disabled; the rest have a known list of destinations"},{"zh":"看过每个服务器的工具描述，工具定义变化时客户端会重新提示","en":"You have skimmed each server’s tool descriptions, and your client re-prompts when a definition changes"}],"team":[{"zh":"维护一份已批准的服务器白名单，并公开准入标准","en":"Maintain an allow-list of approved servers with published acceptance criteria"},{"zh":"持续盘点受管电脑上的 MCP 客户端配置","en":"Continuously inventory MCP client configurations on managed machines"},{"zh":"为本地服务器定一个默认隔离方式并写成文档","en":"Document a default isolation posture for local servers"},{"zh":"保留受管电脑上的 MCP 活动审计日志","en":"Keep audit logs of MCP activity on managed machines"},{"zh":"能对某个服务器全员封禁外连并轮换它的凭据","en":"Be able to block a server’s egress and rotate its credentials across the fleet"}]}}}