Native typed tools; Tacid as an MCP server; third-party MCP untrusted

Context

Tools are where a model touches the machine. MCP is the ecosystem’s connector and must not become a path to root.

The three plans

• Grok: a schema per tool; deny by default except read-ish tools; the model sees only permitted tools.
• Fable: MCP as the tool interface; Tacid ships system MCP servers; users add their own.
• Codex: typed native tools first, a structured system API second, sandboxed shell third, privileged transaction last; MCP as an ecosystem connector, never equal to root; third-party servers untrusted.

Decision

Native tools are typed Rust in-process for trusted data (files, git, process, logs, network facts, packages, system facts, usb/serial/probe, transactions); parsers of untrusted data run in session sandboxes. Execution hierarchy: typed tool → structured API → sandboxed shell → privileged transaction. Deterministic : verbs never touch a model. Tacid exposes an MCP server so other agents can use the machine, each under its own principal and policy. Third-party MCP servers are untrusted integrations behind the same policy; provenance propagates through their output. Browser automation is a sandboxed tool whose page content is untrusted.

Consequences

• No serialization tax for native tools; MCP interoperability for everyone else.
• Another agent driving a Tacid machine gets exactly what its principal is allowed.

Alternatives rejected

• MCP for Tacid’s own system tools: an extra process and codec boundary for no isolation gain, and a temptation to grant privilege to a protocol.