devcontainer template skill: figure out a way to disable MCP/connectors for agents in the container by default (e.g. prevent the agent from accessing github from paps instead of martins-assistant)

[paps]

[martins-assistant]

Conclusion from discussion: setup should let the user choose unrestricted access or an explicit allowed set of MCP servers/connectors. That choice should persist across container starts, with deliberate user changes possible later.

Agent-writable config alone cannot enforce this against a hostile or prompt-injected agent. Enforcement should sit outside the agent's control. An external firewall/gateway can cover traffic leaving the container, provided it cannot be bypassed. However, provider-hosted connectors may execute in the AI provider's cloud, so blocking service destinations at the container boundary is insufficient. Domain filtering also cannot distinguish GitHub accounts.

Before implementing, map the connector request paths and determine where the policy can be reliably enforced. A traffic-inspection firewall alone is not yet a confirmed complete solution.

[paps]

Not doing this until I get to a more general way of filtering traffic, like onecli or similar tooling, for most situations.

Also it seems like connectors at the platform level (e.g. OpenAI) are a bad idea overall, because it means once the agent CLI has my token it can make those calls? Possible fixes for this:

• wait for platforms to implement ways to login the harness (obtaining a token) without providing access to certain connectors
• disconnect all connectors at the platform level except for one that's a general MCP/connector proxy (composio like) that can control access depending on traffic shape or traffic origin?