Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›MCP surface·47 in this wave

Approve: MCP surfaceTo do · blocker 13 production secrets overdue for rotation — the gate cannot be green until this is resolvedTo do · blocker Deploy step 2 — verify/rotate production MCP Worker secretsTo do Deploy step 4 — fix the stale "NOT DEPLOYED" banner and deploy docsDone Add action.* and bluetooth.* op groups to the MCP catalogDone Build real handlers for group.* (9 ops)Done Build real handlers for family.* (7 ops)Done Build settings.* MCP tools including custom domain managementTo do Verify/build the Connected Apps management UI for MCP OAuth clientsDone Add rate limiting, quota, and cost controls to the hosted MCP serverDone Honesty check — reconcile investor deck MCP claims against what shipsTo do Verify "everything a human can do, an agent can do over MCP" end to endTo do staging-api is a day behind main — and writes to the production SupabaseDone MCP GAP INVENTORY — every unwired op, with the decision attached to eachDone Demo account for screenshots + QA — seeder is live, shape is frozenTo do SECURITY: hosted MCP tool agent.approval.resolve may let the model approve its own proposalsDone Approvals: resume re-executes approved rows, REST resolveApproval is non-atomic, inbox.ts selects a missing expires_atTo do Build the full medialink.* MCP tool set (3 ops)Done Build the payment.* connector MCP tool set (3 ops)To do Build the full webhook.* MCP tool set (4 ops)Done Build zap.* MCP tools or explicitly cut Zapier from v1.0 MCP scopeTo do Build link.schedule.repoint, link.compound, wizard.suggest or cut themTo do QA: the public MCP tools page opens without sign-in and lists the tools (desktop web and phone)Blocked Deploy step 1 — verify DB migration + RLS on OAuth tablesDone Deploy step 3 — confirm CF route/DNS for mcp.tactile.to is production-gradeTo do Deploy step 5 — formalize the MCP smoke testTo do Build nfc.lock and nfc.unlock MCP toolsTo do Build contact.vcard.export and contact.delete MCP toolsDone Build linkhub.create and linkhub.delete MCP toolsDone Build videoaudio.create and videoaudio.replace MCP toolsTo do Build document.create and document.replace MCP toolsTo do Build the full social.* MCP tool set (6 ops)To do Build the full paylink.* MCP tool set (4 ops)Done Build wifi.edit MCP toolDone Build the full form.* MCP tool set (7 ops)Done Build the analytics automation layer MCP tools (6 ops)Blocked Wire inbox.list and inbox.mcp_approval to real handlersDone Add architecture test guarding against a second tool-handler implementationDone Publish a public MCP tool manifest / discovery docsDone Webhook signing secret: add the one surface that can reveal itDone A Website destination's URL cannot be edited through the agent surface at allDone SPEC → backend: webhook secret reveal/rotate endpoints + secret_fingerprint on the listDone NEEDS MATTHEW: decide whether resolve_trigger_destination keeps anon EXECUTEDone 5 proposal-only MCP ops are advertised with no task row building themTo do contact.delete MCP tool has no destination-type guard: any hash the caller owns is hard-deletedDone Add rule E to the single-tool-handler-path test: a handler map keyed by tool name must go red (follow-up to #698, t_27dbb775)Done notes.delete, document.delete, menu.delete and videoaudio.delete soft-delete any destination type the caller owns, and report success for a hash that matched nothingDone

Wave

MCP surface

Thesis pillar 3 — "Agentic AI + MCP." The investor deck claims first-in-category MCP-native. Audit (2026-07-26) found the hosted server IS live at mcp.tactile.to with real OAuth production traffic (14 clients, 11 tokens) — but the code's own deploy banner still says "NOT DEPLOYED" (stale), and tool coverage is genuinely incomplete: roughly half the 147-op catalog are proposer stubs that never mutate state, and 2 of 14 destination types (Action, Bluetooth) have zero MCP presence at all. Not cuttable: this is a stated structural moat.

TacTile › Launch TacTile › MCP surface

27/47 done20 open2 open blockers

Selected taskclear

SECURITY: hosted MCP tool agent.approval.resolve may let the model approve its own proposals

DoneOwner · met_665ad7fa

Found overnight 29→30 Sep by the ops sweep (static read, untested): the hosted MCP server appears to expose agent.approval.resolve to the model, and the handler does not check the approval's status or who is resolving it — so an AI client could approve the action it just proposed, bypassing the human approval step.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**SECURITY: hosted MCP tool agent.approval.resolve may let the model approve its own proposals** · done

Found overnight 29→30 Sep by the ops sweep (static read, untested): the hosted MCP server appears to expose agent.approval.resolve to the model, and the handler does not check the approval's status or who is resolving it — so an AI client could approve the action it just proposed, bypassing the human approval step.

Where it sits: TacTile › Launch TacTile › MCP surface

## The brief on file

[CLOSED 1 Oct 2026 — Viv: #663 is LIVE on the MCP Worker]
Deployed tactile-mcp-server from ~/TacTile-dev/TacTile-prod-deploy at 938b9a6c (== GitHub main, contains #663 ad592f08) on Matthew's go-ahead: version 794e6898-31bd-4c6a-a76b-dcc98c7db62a, tag 938b9a6c. Before: last deployment 2026-07-03. MCP_ALLOW_IN_CHAT_APPROVAL and MCP_KILL_SWITCH are both unset on the Worker, so in-chat approval is OFF and destructive actions are app-only. Smoke: /healthz 200 {"ok":true}, /.well-known/oauth-authorization-server 200. Kill switch not used.
Still Matthew's: re-list the TacTile connector in Claude.ai and ChatGPT (tools/list changed; cards in old chats stop approving). Rollback if needed: cd apps/api/tactile-api && pnpm exec wrangler rollback --config wrangler.mcp.jsonc.
[/CLOSED]

[overnight 29→30 Sep] Filed by Viv. UNVERIFIED — static read only.

VERIFY FIRST: is agent.approval.resolve (packages/mcp-server tool registry + its handler, and the API route it calls) reachable by an MCP client's model? What does the handler check (status == pending? same session? a human-only credential?). Write a test that reproduces self-approval if it exists.

DONE WHEN: a model-driven MCP call cannot resolve an approval — either the tool is not model-visible (human UI only) or resolve requires a human-held confirmation the model never sees; resolving a non-pending approval is rejected; tests pin both; `pnpm verify:unit`, `pnpm verify:api-test`, and the mcp-server suite green. If the fix changes a public MCP contract, stop-note Matthew before shipping (third-party OAuth clients use it).

[overnight 29→30 Sep] RESULT (Sonnet subagent for Viv): BLOCKED, NEEDS MATTHEW. The fix changes the public MCP contract.

VERIFIED REAL. On origin/main (1d960865) a connected model approves its own proposal in one turn: call any mutating tool, read structuredContent.pendingActionId, call agent.approval.resolve {decision:"approve"}; the raw handler runs and no human sees a card. Evidence: streamable-http.ts:205-208 registers the resolve tool ungated and listed; server.ts:104-116 drops its visibility:["app"] (it only emits _meta when a resourceUri exists), and MCP Apps gives a server no way to tell an iframe call from a model call anyway; resolve-tool.ts:39-73 never reads status, merges caller-supplied tweaks, executes THEN marks (a failed mark is swallowed); server.ts step-up only sees the called tool, so actions.write approves destructive rows whose ids inbox.list hands to a read-scoped token.
REPRO: tests/unit/mcp-approval-self-approval.test.ts (real Worker fetch, OAuth in-memory, fake PostgREST with RLS + conditional PATCH). origin/main: 10 of 11 FAIL. Branch: 11/11 pass.

FIX: draft PR #663, branch r27/mcp-approval-guard, head fca20213. Contract-preserving: tools/list publishes visibility:["app"]; resolve is pending-only, claims atomically BEFORE executing, applies the target tool's OAuth scope, validates and encodes the id; gate resume is bound to the proposed tool. Contract-changing: approve/tweak need approvalToken (HMAC of user+pending id under the Worker's existing SUPABASE_SERVICE_ROLE_KEY, no new secret), minted with the proposal and delivered ONLY in the tool result's _meta; the card bridge sends it. Reject needs none.

NEEDS MATTHEW BEFORE SHIPPING:
1. OK with the contract change? Card hosts that pass _meta to the iframe keep working (not yet exercised on a real host); hosts that drop _meta show 'open the TacTile app'; no-card clients (Claude Code, Cursor) can no longer have the model approve, the user approves in the app; cards already rendered in old chats stop approving (refresh the connector after deploy).
2. Smoke on a real Claude and a real ChatGPT connector: propose a note, click Approve in the card, expect exactly one note; then ask the model to approve it itself, expect a refusal.
3. Recommended small follow-up: destructive ops approvable only in the app (no token to leak).

CHECKS GREEN (local): verify:unit 4383, api-check, api-test 950, agent-core 22, app-typecheck, web-check, knip, depcruise, test-coverage, no-harness-artifacts, agents-md-references, agents-sync, bin-entrypoints-loadable, ci-step-coverage. 15 mutations of the fix, one per rule, all caught.
FOUND, NOT FIXED: gate resume re-executes approved rows (double execution on the headless flow); REST resolveApproval is check-then-act and executes before marking; inbox.ts SELECTs expires_at which agent_pending_actions lacks (inbox.list likely 400s against prod).
Nothing merged, deployed, or called against the live MCP server.

[overnight 29→30 Sep] UPDATE after an independent review (Sonnet subagent for Viv). PR #663 head 59d9505a, still DRAFT, still BLOCKED: NEEDS MATTHEW = merge + manual deploy of the MCP Worker.
CHANGED: (1) approving from chat is now OFF by default: env MCP_ALLOW_IN_CHAT_APPROVAL, exactly "1" turns it on, read per request, not a secret; off = approve/tweak execute nothing and say "approve in the TacTile app", reject still works, no token minted. (2) Destructive tools (catalog destructiveHint, 31 today; settings.delete_account was the worst case) are NEVER approvable over MCP, flag or not. (3) The card confirmation expires after 15 min. (4) Gate resume no longer re-executes approved rows, it returns the recorded result (the resume item above, t_29065bf2, is fixed here).
DEFAULT: chat cannot approve; Matthew approves in the TacTile app. iOS/Android/web unaffected (REST). Still open: MCP rows have a thin preview in the app inbox, reject needs no token, REST resolve race, unannotated delete-ish tools (nfc.unlink, triggers.disconnect, contact.field.remove, linkhub.link.remove).
MATTHEW'S ONE STEP: gh pr ready 663, merge, then deploy by hand: npx wrangler deploy --config apps/api/tactile-api/wrangler.mcp.jsonc (credential + check steps in the PR body). Leave MCP_ALLOW_IN_CHAT_APPROVAL unset until the smoke tests (Claude.ai, ChatGPT, _meta echo) pass.
KILL SWITCH (optional, shuts the hole before the deploy): printf '1' | npx wrangler secret put MCP_KILL_SWITCH --config apps/api/tactile-api/wrangler.mcp.jsonc. Exactly "1" makes EVERY path 503 (/mcp, oauth, /healthz) for all connectors until removed; set it as a SECRET (a dashboard text var is dropped by the next deploy). Undo: same command with printf '0'.
CHECKS: verify:unit 4442, api-test 950, agent-core 22, api-check, app-typecheck, knip, depcruise, test-coverage, ts-source-coverage green; 36 mutations of the new guards, all red but one equivalent. Nothing merged, deployed or called against production.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

MCP surface

SECURITY: hosted MCP tool agent.approval.resolve may let the model approve its own proposals