Refuse any MCP server that is not on a reviewed allow-list. The agent client checks that identity before it connects, and a server that misses the list does not install. Scan shared prompt packages for hidden format-control characters, require a person to approve tools annotated destructive, and keep more than one model available.
Angie Jones, then VP of Engineering for AI Tools and Enablement at Block, walked through those controls in a January 2026 episode. Her team had rolled Goose, Block's open-source agent, out to all 12,000 Block employees in about eight weeks.
How do you stop employees from installing arbitrary MCP servers?
Put the allow-list in the agent client and refuse any server that is not on it. At Block, Jones said, a server that isn't on the allowed list won't work.
Block handles financial data, so employees could not install a random MCP server from GitHub. The protocol was new, and independent developers had already published thousands of servers. Early servers at Block were built for engineers, including GitHub. Requests then came in for Airtable, Workday, Snowflake, and Figma, and the team built more servers in-house.
The agent will say nope. Can't install it.
Angie Jones, then VP of Engineering for AI Tools and Enablement at Block, on Chain of Thought ep 48
How Block Deployed AI Agents t… - Chain of Thought | AI Agents, Infrastructure & Engineering - Apple Podcasts
Podcast Episode · Chain of Thought | AI Agents, Infrastructure & Engineering · January 21 · 50m
podcasts.apple.com
Check the identity of the server the client is about to launch, not a display name. Add an ID only after security review, and remove it when the server should stop running; the next attempt fails the same check.
Shared prompt packages need a scan before the client accepts them. Jones described recipes as a shared workflow: system instructions, a prompt, and MCP servers in one bundle. One finding from her red team: someone could hide invisible characters in that kind of packaged prompt. A file can look like a normal workflow and still carry characters a person will not see in a typical editor. Unicode category Cf is the format-control class, including zero-width characters. A strict policy is to reject the file if any character is in that class. That can catch legitimate text too (some languages and emoji sequences use these characters), so treat it as one check alongside reviewing the recipe, not proof it's safe.
A minimal sketch to adapt, not a drop-in library.
import unicodedata
ALLOWED_SERVERS = {
"incidents.internal",
"source.internal",
}
def connect_server(server_id):
if server_id not in ALLOWED_SERVERS:
raise PermissionError(f"refusing {server_id}: not on the allow-list")
def reject_hidden_controls(prompt_text):
for char in prompt_text:
if unicodedata.category(char) == "Cf":
raise ValueError("shared prompt contains a format-control character")
Call reject_hidden_controls on the recipe text before the client accepts the package. Call connect_server with the server ID before the client starts that server.
Why review an MCP server your own team built?
An in-house server can still be wrong. Jones said the majority of servers on Block's list are ones they built, and that only a handful of official corporate servers are accepted from outside. Security reviews a server before its ID is added, including one written inside the company.
even if I built one, security needs to review it to make sure I didn't miss something. ... everything is not intentionally malicious. Sometimes we just don't know
Angie Jones, then VP of Engineering for AI Tools and Enablement at Block, on Chain of Thought ep 48
The review is how an ID earns a place on the list. The same security team also builds guardrails against prompt injection into Block's AI products, and its red team is where the recipe finding came from:
if I'm a malicious person, I put some invisible characters in there that's like, you know, doing not so nice things on your on your system.
Angie Jones, then VP of Engineering for AI Tools and Enablement at Block, on Chain of Thought ep 48
So treat a recipe as untrusted input, even one a coworker sends. If the scan fails, load none of it: not the instructions, the prompt, or the server list.
How do you make a destructive tool wait for a person?
Annotate tools that can change, edit, or delete, and require a person to approve those calls. Block doesn't do this per model. They annotate the tool as destructive, which she defined as able to change things, edit, or delete. The agent may run tools that are not destructive. A destructive tool has to ask first, show what it is trying to do, and wait for a yes or no.
Reads stay automatic; writes and deletes wait. One addition of mine: if a tool has no annotation yet, treat it as destructive until someone classifies it.
Should a company standardize on one model?
Leave the model choice open. Jones said no one has won this race yet. In any given week, the model people treat as best can come from a different provider, so locking in on one would be foolish. The models also have different strengths. Anthropic's models are the ones Block's engineers typically use for software development. Job functions that rely more on reasoning may want a GPT model.
Block reaches those models through Databricks, which she described as a hosting service. She named Gemini models from Google, GPT models from OpenAI, and models from Anthropic. Local open-source models are an option too, but agentic work needs the larger models, so the engineers who use them upgraded their machines. She put that group at a very small percentage.
Keep the allow-list, the recipe scan, and destructive-tool approval in the client. Those checks stay put whichever permitted model answers.
FAQ
What happens if an MCP server is not on the allow-list?
The client refuses it. "The agent will say nope." A server is added only after security review.
Do servers built in-house skip security review?
No. Jones said even a server she built goes through security review, because not every problem is malicious; sometimes the author just missed something.
Does everyone have to use the same model?
No. Jones's view is that no one has won the model race yet, so locking in on one would be a mistake. Gemini, GPT, and Anthropic models are available through Databricks. She said only a very small percentage of engineers have upgraded their machines to run local open-source models.
Takeaway
- Check server identity against an allow-list in the agent client, and refuse anything not on it.
- Send every server through security review before it is added, including servers written in-house.
- Treat shared recipes as untrusted files. Reject text that contains Unicode format-control characters (
Cf). - Let non-destructive tools run, and require a person to approve tools annotated destructive.
- Keep more than one model available. Different jobs lean on different strengths, and the best model can come from a different provider in any given week.
The full conversation, with the transcript, is on Chain of Thought.
Subscribe to the Chain of Thought newsletter for new episodes and write-ups like this one.
Drafted with AI assistance from the episode transcripts.
Top comments (0)