Tool connections turn a model from a conversational surface into an actor. That can be useful. It also means every forgotten server, inherited token, and broad filesystem grant remains a real capability after the setup tutorial has faded from memory.
Inventory before optimization.
List every connected server and tool. For each one, record what it can read, what it can change, where its credentials live, and whether it is still used. If ownership or purpose is unclear, disable it while you investigate.
| Question | Good answer | Warning sign |
|---|---|---|
| What can it read? | Named folders, APIs, or records | “Probably the workspace” |
| What can it change? | Explicit operations with confirmation | Shell access inherited from setup |
| Which identity does it use? | Dedicated, scoped credentials | Your personal all-purpose token |
| Who maintains it? | Known source and update path | A gist from a launch thread |
Prefer the least interesting permission.
Grant read access before write access, a project folder before a home directory, and a dedicated account before a personal one. Require confirmation for destructive, external, or costly actions. Isolation is not distrust. It is how useful systems remain useful after mistakes.
Convenience is not consent that lasts forever.
Run a monthly subtraction.
- Revoke credentials for tools you no longer use.
- Rotate long-lived secrets and remove them from logs or prompt archives.
- Review recent tool activity for actions you did not expect.
- Update maintained servers; remove abandoned ones.
- Test that confirmation boundaries still stop the action they describe.
Keep a manual path.
Know how to complete critical work without the agent. Manual access is both a recovery mechanism and a way to understand what the automation is doing on your behalf.