Review a Read-Only PostgreSQL MCP Tool Before You Ship It
Review database permissions, tenant identity, query time and response size in a Rust MCP tool. Use a real restricted PostgreSQL role to check the boundaries.
Rust AI tool boundaries
Carry identity, permissions, approval, and resource limits to the place effects happen. Each guide gives a concrete reproduction, the resulting decision, and the limits of the evidence.
Why pgvector Returns Too Few Results After Filtering
Your tenant has enough documents, but an HNSW query returns too few. Compare real plans, iterative scans, and an exact fallback without weakening access checks.
Start an internal AI tool with read-only access
Roll out one narrow internal assistant before adding write actions. Read-only still requires authorization, output limits, and checks against private-data exposure.
The model should not choose whose credentials it uses
Resolve tool credentials from trusted server context. A model-selected account must be checked against the acting user's current permissions before any secret is used.
Log the tool decision without copying the customer's document
Design a small tool-audit event around identity, policy, decision, and outcome. Test secret leakage in errors as well as normal logs.
Only offer tools that belong to the current workflow
Build tool manifests for the current task instead of exposing an entire backend. Keep independent server authorization because hiding a tool does not prevent a fabricated call.
A denied tool call must leave no side effect
An error response does not prove that a tool did nothing. Validate and authorize before effects, then assert unchanged storage and zero external calls after rejection.
A fallback model must not get wider permissions
An automatic model fallback should preserve actor scope, tools, approvals, and budgets. Never turn a provider failure into a switch to an administrative execution context.
Your agent test should not be able to send a real email
Capture agent mail effects in a test adapter and keep production credentials out of the environment. A prompt telling the agent to stay in test mode is not an enforcement boundary.
Even a trusted tool needs an output limit
Bound tool results before they become model context or logs. Use explicit pagination or overflow errors so partial data cannot look like a complete answer.
Don't delete the eval case that made the release look bad
Keep reproducible failures in a versioned evaluation set. Retire obsolete cases with a recorded reason, and separate requirement changes from attempts to improve a release score.
An overall eval score can hide the workflow you broke
Compare important workflows as well as the overall evaluation result. Report case counts and uncertainty so an aggregate gain cannot hide a smaller critical regression.