Tagged MCP · show all articles
Reported tool-call success rates, schema-token overhead, and attack-success rates against MCP servers are all measured — by different labs, on different harnesses, against different definitions of success — and the numbers rarely agree.
A tool call is not a function call. It is a message crossing a wire between three separately-trusted roles, and the point where it crosses — not the wire format itself — is where a tool protocol's security actually lives or fails.
Claude Code, IDE copilots, autonomous cloud agents, and plan-then-execute systems all give a model shell and file access — but each places approval, memory, and verification somewhere different, and it does not collapse into a ranking.
Antigravity gives Gemini sandboxes, hooks, skills, subagents and MCP. But a tool-rich agent still fails when it rushes through evidence, stops early and mistakes a plausible partial result for completed work.
Claude Code ships its own permission system, hooks, subagents, and memory files. Each is documented, each has already failed in a specific and traceable way, and each failure is distinct from a generic "AI agent risk."
Claude Code is not a chatbot with a code icon. It is an agentic harness: a loop that calls a model, executes real shell and filesystem operations behind a permission gate, and manages a shrinking context budget one turn at a time.
Coding-agent security is a systems property: untrusted observations become dangerous when they can steer broad tools, credentials, mutable tests, and irreversible actions.
The consequential differences are in trust boundaries, configuration, state, hooks, subagents, and workflow—not whichever model topped a changing leaderboard this week.
Codex, Claude Code, RAG, and MCP make more sense when treated as components in a measured feedback system rather than as personalities with tools.