Remote MCP Servers and Security

// Two instances of the same MCP server behind a round-robin "load balancer": stateful sessions vs stateless mode.
import { randomUUID } from "node:crypto";
import { z } from "zod";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

const shared = new Map(); // stands in for Redis or a database that every instance can reach
let nextHandle = 1; // a real server would mint random, user-bound handles (see the walkthrough)
function buildServer() {
  const server = new McpServer({ name: "rooms", version: "1.0.0" });
  server.registerTool("new_shortlist", { description: "Start a shortlist; returns its handle" }, async () => {
    const handle = `sl_${nextHandle++}`;
    shared.set(handle, []);
    return { content: [{ type: "text", text: handle }] };
  });
  server.registerTool("pick_room", { description: "Add a room to a shortlist", inputSchema: { shortlist: z.string(), roomId: z.string() } },
    async ({ shortlist, roomId }) => {
      shared.get(shortlist).push(roomId);
      return { content: [{ type: "text", text: `${shortlist}: ${shared.get(shortlist).join(", ")}` }] };
    });
  return server;
}

async function startInstance(name, stateful) {
  const app = createMcpExpressApp();
  const sessions = new Map();
  app.post("/mcp", async (req, res) => {
    const id = req.headers["mcp-session-id"];
    if (stateful && id) {
      if (sessions.has(id)) return sessions.get(id).handleRequest(req, res, req.body);
      return res.status(404).json({ jsonrpc: "2.0", error: { code: -32001, message: `Session not found on ${name}` }, id: null });
    }
    if (stateful && !isInitializeRequest(req.body)) return res.status(400).end();
    const transport = new StreamableHTTPServerTransport(stateful
      ? { sessionIdGenerator: () => randomUUID(), onsessioninitialized: (sid) => sessions.set(sid, transport) }
      : { sessionIdGenerator: undefined, enableJsonResponse: true }); // stateless: a fresh pair per request
    const server = buildServer();
    if (!stateful) res.on("close", () => { transport.close(); server.close(); });
    await server.connect(transport);
    await transport.handleRequest(req, res, req.body);
  });
  app.get("/mcp", (req, res) => res.status(405).end());
  const http = app.listen(0, "127.0.0.1");
  await new Promise((resolve) => http.once("listening", resolve));
  return { name, http, sessions, url: `http://127.0.0.1:${http.address().port}/mcp` };
}

async function run(stateful) {
  console.log(stateful ? "== stateful (sessions in each instance's memory)" : "== stateless (any instance serves any request)");
  const pool = [await startInstance("instance-1", stateful), await startInstance("instance-2", stateful)];
  let turn = 0;
  const balancer = async (input, init) => {
    if (init.method === "GET") return fetch(pool[0].url, init); // the client's optional GET stream; both answer 405
    const target = pool[turn++ % pool.length];
    const res = await fetch(target.url, init);
    console.log(`  ${(JSON.parse(init.body).method ?? "").padEnd(25)} -> ${target.name}: ${res.status}`);
    return res;
  };
  const client = new Client({ name: "host", version: "1.0.0" });
  try {
    await client.connect(new StreamableHTTPClientTransport(new URL("http://lb.invalid/mcp"), { fetch: balancer }));
    const handle = (await client.callTool({ name: "new_shortlist", arguments: {} })).content[0].text;
    for (const roomId of ["huddle-2", "board-1"]) {
      const r = await client.callTool({ name: "pick_room", arguments: { shortlist: handle, roomId } });
      console.log(`  result: ${r.content[0].text}`);
    }
  } catch (e) {
    console.log(`  client error: ${e.message}`);
  }
  await client.close();
  for (const i of pool) {
    for (const t of i.sessions.values()) await t.close();
    i.http.close();
  }
}
await run(true);
await run(false);

== stateful (sessions in each instance's memory)
  initialize                -> instance-1: 200
  notifications/initialized -> instance-2: 404
  client error: Streamable HTTP error: Error POSTing to endpoint: {"jsonrpc":"2.0","error":{"code":-32001,"message":"Session not found on instance-2"},"id":null}
== stateless (any instance serves any request)
  initialize                -> instance-1: 200
  notifications/initialized -> instance-2: 202
  tools/call                -> instance-1: 200
  tools/call                -> instance-2: 200
  result: sl_1: huddle-2
  tools/call                -> instance-1: 200
  result: sl_1: huddle-2, board-1

// What a DNS-rebinding page's requests look like to a localhost MCP server, and the two checks that stop them.
import { request } from "node:http";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";

const app = createMcpExpressApp(); // host 127.0.0.1 by default, so it adds Host-header validation
const allowedOrigins = new Set(["http://localhost:6274"]); // e.g. your own local web UI, if you have one
app.use((req, res, next) => { // the transport's own Origin option is deprecated in favour of middleware
  const origin = req.headers.origin;
  if (origin && !allowedOrigins.has(origin)) return res.status(403).json({ jsonrpc: "2.0", error: { code: -32000, message: `Origin not allowed: ${origin}` }, id: null });
  next();
});
app.post("/mcp", async (req, res) => {
  const server = new McpServer({ name: "local-files", version: "1.0.0" });
  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
  res.on("close", () => { transport.close(); server.close(); });
  await server.connect(transport);
  await transport.handleRequest(req, res, req.body);
});
const http = app.listen(0, "127.0.0.1");
await new Promise((resolve) => http.once("listening", resolve));
const port = http.address().port;

function post(label, headers) { // node:http, because fetch() won't let you set Host yourself
  const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2025-11-25", capabilities: {}, clientInfo: { name: "x", version: "0" } } });
  return new Promise((resolve) => {
    const req = request({ host: "127.0.0.1", port, path: "/mcp", method: "POST",
      headers: { "content-type": "application/json", accept: "application/json, text/event-stream", ...headers } }, (res) => {
      let text = "";
      res.on("data", (d) => (text += d)).on("end", () => {
        const json = JSON.parse(text);
        console.log(`${label.padEnd(34)} ${res.statusCode} ${json.error ? json.error.message : `serverInfo.name=${json.result.serverInfo.name}`}`);
        resolve();
      });
    });
    req.end(body);
  });
}
await post("host app (no Origin)", { host: `127.0.0.1:${port}` });
await post("rebinding page, after DNS switch", { host: `evil.example:${port}`, origin: `http://evil.example:${port}` });
await post("cross-site page, real Host", { host: `localhost:${port}`, origin: "https://evil.example" });
await post("your own local UI", { host: `localhost:${port}`, origin: "http://localhost:6274" });
http.close();

host app (no Origin)               200 serverInfo.name=local-files
rebinding page, after DNS switch   403 Invalid Host: evil.example
cross-site page, real Host         403 Origin not allowed: https://evil.example
your own local UI                  200 serverInfo.name=local-files

// What an MCP client does when a remote server says 401: the SDK's discovery and PKCE, up to the browser redirect.
import { createHash } from "node:crypto";
import express from "express";
import { mcpAuthMetadataRouter, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";

const listen = async (app) => { const h = app.listen(0, "127.0.0.1"); await new Promise((r) => h.once("listening", r)); return h; };
// The authorization server: only its metadata document. Its login page and token endpoint aren't built here.
const asApp = express();
const asHttp = await listen(asApp);
const AS = `http://127.0.0.1:${asHttp.address().port}`;
asApp.get("/.well-known/oauth-authorization-server", (req, res) => res.json({ issuer: AS, authorization_endpoint: `${AS}/authorize`,
  token_endpoint: `${AS}/token`, response_types_supported: ["code"], code_challenge_methods_supported: ["S256"], client_id_metadata_document_supported: true }));
// The MCP server: protected resource metadata, and a Bearer check that no token passes yet.
const mcpApp = express();
const mcpHttp = await listen(mcpApp);
const MCP = new URL(`http://127.0.0.1:${mcpHttp.address().port}/mcp`);
mcpApp.use(mcpAuthMetadataRouter({ resourceServerUrl: MCP, scopesSupported: ["devices:read"], oauthMetadata: { issuer: AS, authorization_endpoint: `${AS}/authorize`, token_endpoint: `${AS}/token`, response_types_supported: ["code"] } }));
mcpApp.post("/mcp", requireBearerAuth({ verifier: { verifyAccessToken: async () => { throw new InvalidTokenError("unknown token"); } },
  requiredScopes: ["devices:read"], resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(MCP) }));

const hide = (s) => String(s).replaceAll(AS, "<auth-server>").replaceAll(MCP.origin, "<mcp-server>");
const loggingFetch = async (input, init = {}) => { // every request the SDK makes, in order
  const res = await fetch(input, init);
  console.log(`${(init.method ?? "GET").padEnd(4)} ${hide(input)} -> ${res.status}`);
  return res;
};
let codeVerifier;
const provider = { // the host's side of OAuth: where it keeps client info, tokens and the PKCE verifier
  clientMetadataUrl: "https://host.example.com/oauth/client.json", // a Client ID Metadata Document
  redirectUrl: "http://127.0.0.1:33418/callback",
  clientMetadata: { client_name: "Example host", redirect_uris: ["http://127.0.0.1:33418/callback"], grant_types: ["authorization_code"], token_endpoint_auth_method: "none" },
  clientInformation: () => undefined, saveClientInformation: () => {}, tokens: () => undefined, saveTokens: () => {},
  saveCodeVerifier: (v) => (codeVerifier = v), codeVerifier: () => codeVerifier,
  redirectToAuthorization(url) { // a real host opens the system browser here
    console.log("\nopen the browser at", hide(url.origin + url.pathname));
    for (const [k, v] of url.searchParams) console.log(`  ${k.padEnd(21)} ${["code_challenge"].includes(k) ? `<${v.length} chars>` : hide(v)}`);
    const expected = createHash("sha256").update(codeVerifier).digest("base64url");
    console.log("  code_challenge == base64url(sha256(verifier)):", url.searchParams.get("code_challenge") === expected);
  },
};
const client = new Client({ name: "host", version: "1.0.0" });
try {
  await client.connect(new StreamableHTTPClientTransport(MCP, { authProvider: provider, fetch: loggingFetch }));
} catch (e) {
  console.log(`\nconnect() threw ${e.constructor.name}: ${e instanceof UnauthorizedError ? "waiting for the user to log in" : e.message}`);
}
asHttp.close();
mcpHttp.close();

POST <mcp-server>/mcp -> 401
GET  <mcp-server>/.well-known/oauth-protected-resource/mcp -> 200
GET  <auth-server>/.well-known/oauth-authorization-server -> 200

open the browser at <auth-server>/authorize
  response_type         code
  client_id             https://host.example.com/oauth/client.json
  code_challenge        <43 chars>
  code_challenge_method S256
  redirect_uri          http://127.0.0.1:33418/callback
  scope                 devices:read
  resource              <mcp-server>/mcp
  code_challenge == base64url(sha256(verifier)): true

connect() threw UnauthorizedError: waiting for the user to log in

// The spec says: no code_challenge_methods_supported in the AS metadata -> refuse. What SDK 1.32.2 does, and a guard.
import { startAuthorization } from "@modelcontextprotocol/sdk/client/auth.js";

const base = { issuer: "https://auth.example.com", authorization_endpoint: "https://auth.example.com/authorize",
  token_endpoint: "https://auth.example.com/token", response_types_supported: ["code"] };
const servers = {
  "S256 advertised": { ...base, code_challenge_methods_supported: ["S256"] },
  "only plain": { ...base, code_challenge_methods_supported: ["plain"] },
  "field missing": base,
};
const options = (metadata) => ({ metadata, clientInformation: { client_id: "https://host.example.com/oauth/client.json" },
  redirectUrl: "http://127.0.0.1:33418/callback", resource: new URL("https://mcp.example.com/mcp") });

function requirePkceS256(metadata) { // what the spec asks every MCP client to check before redirecting
  const methods = metadata.code_challenge_methods_supported;
  if (!methods) throw new Error("authorization server does not advertise PKCE: refusing to proceed");
  if (!methods.includes("S256")) throw new Error(`no S256 in ${JSON.stringify(methods)}: refusing to proceed`);
}
for (const [name, metadata] of Object.entries(servers)) {
  let sdk, guarded;
  try { await startAuthorization(metadata.issuer, options(metadata)); sdk = "redirects"; } catch (e) { sdk = `throws: ${e.message}`; }
  try { requirePkceS256(metadata); guarded = "redirects"; } catch (e) { guarded = `refuses: ${e.message}`; }
  console.log(`${name}\n  SDK startAuthorization: ${sdk}\n  with the guard first:  ${guarded}`);
}

S256 advertised
  SDK startAuthorization: redirects
  with the guard first:  redirects
only plain
  SDK startAuthorization: throws: Incompatible auth server: does not support code challenge method S256
  with the guard first:  refuses: no S256 in ["plain"]: refusing to proceed
field missing
  SDK startAuthorization: redirects
  with the guard first:  refuses: authorization server does not advertise PKCE: refusing to proceed

// What the SDK 1.32.2 client does after "403 insufficient_scope": which scope it asks for, and what a stored refresh token changes.
import express from "express";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

const listen = async (app) => { const h = app.listen(0, "127.0.0.1"); await new Promise((r) => h.once("listening", r)); return h; };
const asApp = express().use(express.urlencoded({ extended: false })); // the authorization server: metadata and a token endpoint
const asHttp = await listen(asApp);
const AS = `http://127.0.0.1:${asHttp.address().port}`;
asApp.get("/.well-known/oauth-authorization-server", (req, res) => res.json({ issuer: AS, authorization_endpoint: `${AS}/authorize`,
  token_endpoint: `${AS}/token`, response_types_supported: ["code"], code_challenge_methods_supported: ["S256"] }));
asApp.post("/token", (req, res) => res.json({ access_token: "read-token-2", token_type: "Bearer", expires_in: 300 })); // a refresh keeps the scopes
const mcpApp = express().use(express.json());
const mcpHttp = await listen(mcpApp);
const MCP = new URL(`http://127.0.0.1:${mcpHttp.address().port}/mcp`);
const prm = `${MCP.origin}/.well-known/oauth-protected-resource/mcp`;
mcpApp.get("/.well-known/oauth-protected-resource/mcp", (req, res) => res.json({ resource: MCP.href, authorization_servers: [AS], scopes_supported: ["devices:read"] }));
mcpApp.get("/mcp", (req, res) => res.status(405).end()); // no GET stream; the client carries on without it
let challenge; // what the server puts in scope="…" when a read-only token calls reboot_device
mcpApp.post("/mcp", (req, res, next) => { // every token here is read-only; reboot_device needs devices:write
  if (req.body.method !== "tools/call") return next();
  res.set("WWW-Authenticate", `Bearer error="insufficient_scope", scope="${challenge}", resource_metadata="${prm}"`);
  res.status(403).json({ error: "insufficient_scope" });
}, async (req, res) => {
  const server = new McpServer({ name: "fleet", version: "1.0.0" });
  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
  res.on("close", () => { transport.close(); server.close(); });
  await server.connect(transport);
  await transport.handleRequest(req, res, req.body);
});

const hide = (s) => String(s).replaceAll(AS, "<auth-server>").replaceAll(MCP.origin, "<mcp-server>");
async function run(label, challengeScope, storedRefreshToken) {
  challenge = challengeScope;
  console.log(`== ${label}`);
  const provider = {
    redirectUrl: "http://127.0.0.1:33418/callback", clientMetadata: { client_name: "host", redirect_uris: ["http://127.0.0.1:33418/callback"] },
    clientInformation: () => ({ client_id: "pre-registered", issuer: AS }), saveClientInformation: () => {},
    tokens: () => ({ access_token: "read-token", token_type: "Bearer", scope: "devices:read", issuer: AS, ...(storedRefreshToken && { refresh_token: "rt-1" }) }),
    saveTokens: (t) => console.log(`  saveTokens: ${t.access_token}`), saveCodeVerifier: () => {}, codeVerifier: () => "unused",
    redirectToAuthorization: (url) => console.log(`  browser opens /authorize with scope=${url.searchParams.get("scope")}`),
  };
  const loggingFetch = async (input, init = {}) => {
    const res = await fetch(input, init);
    if ((init.method ?? "GET") === "GET" && String(input) === MCP.href) return res; // the optional GET stream runs in the background: not logged
    const what = init.body && typeof init.body === "string" && init.body.startsWith("{") ? JSON.parse(init.body).method ?? "" : String(init.body ?? "").split("&")[0];
    console.log(`  ${(init.method ?? "GET").padEnd(4)} ${hide(input)}${what ? ` ${what}` : ""} -> ${res.status}`);
    return res;
  };
  const client = new Client({ name: "host", version: "1.0.0" });
  try {
    await client.connect(new StreamableHTTPClientTransport(MCP, { authProvider: provider, fetch: loggingFetch }));
    await client.callTool({ name: "reboot_device", arguments: { id: "huddle-2" } });
  } catch (e) {
    console.log(`  callTool threw ${e.constructor.name}: ${e.message}`);
  }
  await client.close();
}
await run("challenge names only the missing scope", "devices:write", false);
await run("challenge names old + missing scopes", "devices:read devices:write", false);
await run("old + missing scopes, refresh token stored", "devices:read devices:write", true);
asHttp.close();
mcpHttp.close();

== challenge names only the missing scope
  POST <mcp-server>/mcp initialize -> 200
  POST <mcp-server>/mcp notifications/initialized -> 202
  POST <mcp-server>/mcp tools/call -> 403
  GET  <mcp-server>/.well-known/oauth-protected-resource/mcp -> 200
  GET  <auth-server>/.well-known/oauth-authorization-server -> 200
  browser opens /authorize with scope=devices:write
  callTool threw UnauthorizedError: Unauthorized
== challenge names old + missing scopes
  POST <mcp-server>/mcp initialize -> 200
  POST <mcp-server>/mcp notifications/initialized -> 202
  POST <mcp-server>/mcp tools/call -> 403
  GET  <mcp-server>/.well-known/oauth-protected-resource/mcp -> 200
  GET  <auth-server>/.well-known/oauth-authorization-server -> 200
  browser opens /authorize with scope=devices:read devices:write
  callTool threw UnauthorizedError: Unauthorized
== old + missing scopes, refresh token stored
  POST <mcp-server>/mcp initialize -> 200
  POST <mcp-server>/mcp notifications/initialized -> 202
  POST <mcp-server>/mcp tools/call -> 403
  GET  <mcp-server>/.well-known/oauth-protected-resource/mcp -> 200
  GET  <auth-server>/.well-known/oauth-authorization-server -> 200
  POST <auth-server>/token grant_type=refresh_token -> 200
  saveTokens: read-token-2
  POST <mcp-server>/mcp tools/call -> 403
  callTool threw StreamableHTTPError: Streamable HTTP error: Server returned 403 after trying upscoping

// Does SDK 1.32.2 use authorization server metadata whose "issuer" doesn't match the URL it came from?
import express from "express";
import { discoverAuthorizationServerMetadata } from "@modelcontextprotocol/sdk/client/auth.js";

const app = express();
const http = app.listen(0, "127.0.0.1");
await new Promise((resolve) => http.once("listening", resolve));
const ATTACKER = `http://127.0.0.1:${http.address().port}`; // the AS that a malicious MCP server's metadata pointed at
app.get("/.well-known/oauth-authorization-server", (req, res) => res.json({
  issuer: "https://login.honest.example", // claims to be someone else
  authorization_endpoint: `${ATTACKER}/authorize`, token_endpoint: `${ATTACKER}/token`,
  response_types_supported: ["code"], code_challenge_methods_supported: ["S256"] }));
const hide = (s) => s.replaceAll(ATTACKER, "<attacker>");

function requireMatchingIssuer(expected, metadata) { // RFC 8414 §3.3, and MUST NOT use in MCP 2026-07-28
  if (metadata.issuer !== expected) throw new Error(`issuer ${metadata.issuer} != ${hide(expected)}: not using this metadata`);
  return metadata;
}
const metadata = await discoverAuthorizationServerMetadata(ATTACKER); // what auth() calls after reading authorization_servers
console.log("fetched from:          <attacker>/.well-known/oauth-authorization-server");
console.log("SDK returned issuer:  ", metadata.issuer);
console.log("SDK token_endpoint:   ", hide(metadata.token_endpoint));
try { requireMatchingIssuer(ATTACKER, metadata); } catch (e) { console.log("with the guard:        refused:", e.message); }
http.close();

fetched from:          <attacker>/.well-known/oauth-authorization-server
SDK returned issuer:   https://login.honest.example
SDK token_endpoint:    <attacker>/token
with the guard:        refused: issuer https://login.honest.example != <attacker>: not using this metadata

// A host-side policy for the "toxic flow" in Invariant Labs' GitHub MCP write-up (26 May 2025).
// The tool calls are scripted: they are the sequence the write-up describes, not output from a model.
const repos = { "acme/website": "public", "acme/salaries": "private" };
const flow = [ // after reading an attacker's issue, the agent reads private data and publishes it
  { tool: "list_issues", args: { repo: "acme/website" } },
  { tool: "get_file", args: { repo: "acme/salaries", path: "2026.csv" } },
  { tool: "create_pull_request", args: { repo: "acme/website", title: "About the author", body: "<contents of 2026.csv>" } },
];
function legs({ tool, args }) { // what this call adds to the session: the three legs of Simon Willison's trifecta
  const visibility = repos[args.repo];
  return {
    untrusted: tool === "list_issues" && visibility === "public", // anyone can write a public issue
    private: tool === "get_file" && visibility === "private",
    egress: tool === "create_pull_request" && visibility === "public", // publishing where the attacker can read it
  };
}
function runSession(name, policy) {
  console.log(`== ${name}`);
  const seen = { untrusted: false, private: false, egress: false };
  for (const call of flow) {
    const add = legs(call);
    const after = Object.fromEntries(Object.keys(seen).map((k) => [k, seen[k] || add[k]]));
    const verdict = policy(call, after);
    console.log(`  ${call.tool.padEnd(20)} ${call.args.repo.padEnd(14)} -> ${verdict}`);
    if (!verdict.startsWith("run")) return;
    Object.assign(seen, after);
  }
  console.log("  private data published to a public repo");
}
const complete = (s) => s.untrusted && s.private && s.egress;
runSession("always allow (what many users click)", () => "run");
runSession("ask a human when the trifecta would complete", (call, after) => {
  if (!complete(after)) return "run (no approval needed)";
  return `ASK: "${call.tool} to ${call.args.repo}, body ${JSON.stringify(call.args.body)}. This session read untrusted ` +
    `content and private data. Allow?" -> user says no`;
});
let pinned; // Invariant's suggested policy: one repository per session
runSession("one repository per session", (call) => {
  pinned ??= call.args.repo;
  return call.args.repo === pinned ? "run" : `BLOCK: session is pinned to ${pinned}`;
});

== always allow (what many users click)
  list_issues          acme/website   -> run
  get_file             acme/salaries  -> run
  create_pull_request  acme/website   -> run
  private data published to a public repo
== ask a human when the trifecta would complete
  list_issues          acme/website   -> run (no approval needed)
  get_file             acme/salaries  -> run (no approval needed)
  create_pull_request  acme/website   -> ASK: "create_pull_request to acme/website, body "<contents of 2026.csv>". This session read untrusted content and private data. Allow?" -> user says no
== one repository per session
  list_issues          acme/website   -> run
  get_file             acme/salaries  -> BLOCK: session is pinned to acme/website