Review steps
- Allow read-only tools by default only when source and auth checks pass.
- Require approval for write, execute, destructive, and financial categories.
- Block tools that lack enough context or have irreversible impact.
- Review drift whenever the server exposes a new tool.