u/BitByLiu

MCP makes coding agents much more useful, but it also makes me pause before connecting anything with real write access.

Read-only tools feel easy to justify. Let the agent search docs, inspect issues, query logs, maybe read database schema. That saves time and the blast radius is limited. But the moment a tool can mutate something, I get much more careful. Send email. Edit production data. Change DNS. Close GitHub issues. Touch billing. Modify local network config. Those are not “just coding” anymore.

GitHub was the clearest example for me: letting the agent read issues, PR diffs, and CI logs felt obviously worth it, but I still won't give it merge, push, or close-issue powers without me re-reading the diff line by line.

I know approval prompts help, but I’m not fully relaxed about them. If the agent is in a long task and I’m tired, I can still approve a command too quickly. And for remote MCP, I also have to trust the server, the permissions, the logs, and my own memory of what I connected last week.

How are people drawing the line here? Do you make MCP tools read-only by default? Which actions require human approval every time? Are there tools you simply refuse to expose to agents? And for solo projects, do you use separate tokens with tiny permissions, or is that too much overhead?

Maybe I’m too cautious, but I would rather have a slightly slower agent than one that can quietly change the wrong thing.

I learned that ancient Roman laundries used urine to clean clothes.

Apparently the ammonia helped remove grease and stains, so fullers would collect urine and use it in the cleaning process.

Which makes sense chemically.

But I can’t stop thinking about the logistics.

Somewhere in Rome, there was basically a supply chain where public toilets helped keep people’s clothes clean.

Imagine dropping off your toga and asking:

“Is this the regular wash?”

“No, sir. Premium urine treatment. Very fresh batch.”

I know it worked, but this is one of those historical facts that makes modern laundry detergent feel like a miracle.

I learned that old city rat catchers sometimes carried live rats with them to use as bait.

I understand the logic.

But there is something very funny about hiring a man to solve your rat problem and he shows up with more rats.

“Don’t worry, these are professional rats.”

It feels like calling tech support and the guy arrives with three extra errors just to demonstrate the workflow.

I learned that old city rat catchers sometimes carried live rats with them to use as bait.

I understand the logic.

But there is something very funny about hiring a man to solve your rat problem and he shows up with more rats.

“Don’t worry, these are professional rats.”

It feels like calling tech support and the guy arrives with three extra errors just to demonstrate the workflow.

For almost a year now, I’ve been using this workflow: let Claude Code write the first pass, then ask Codex to review the diff like a second reviewer.

Not because I think Codex is “better” than Claude Code. More like they fail in different ways. Claude Code is often good at moving fast across files. Codex, at least in my setup, feels more useful when I ask it to be annoying: check edge cases, missing tests, security-ish mistakes, and whether the patch actually matches the request.

Once, after Claude Code updated a pagination endpoint, Codex flagged that page=0 or an empty limit would throw a 500 — while the original implementation only had tests for normal page numbers.

The part I’m unsure about: maybe this is just making me feel safer while spending more tokens. It also adds another layer to review, and sometimes two agents disagree in a very unhelpful way.

Curious how other people handle this:

Do you use one AI coding tool to review another tool’s output?

I'm not trying to rank these tools. I'm more interested in whether "agent writes + different agent reviews" is becoming a normal pattern.

One time I ran Claude in a loop for four or five hours to build a program, then had Codex and Cursor review the code. Each pass surfaced different issues, but the codebase was so large that I could only trust what they flagged.

I've been using coding agents more seriously in my own projects recently, and the part that feels expensive is not the generation anymore. It is the review.

A patch can appear in 2 minutes. But then I still need to check the diff, run tests, read logs, and ask myself whether the change is only "passing" or actually going in the right direction. Maybe this is just my setup, but I trust an agent-written change much more when it comes with some evidence: what command it ran, what failed before, what passed after, and what files it intentionally did not touch.

One time I ran Claude in a loop for four or five hours to build a program, then had Codex and Cursor review the code. Each pass surfaced different issues, but the codebase was so large that I could only trust what they flagged.

I'm not trying to say AI coding is bad. It is useful. But it changed my review work from "read every line slowly" to "ask for proof and inspect the risky parts."

Curious how other people handle this:

Do you ask your coding agent to include test output in every PR?

Do you use another model/tool to review the first model's code?

If tests pass but the design feels wrong, do you count that as agent success?

What evidence makes you trust an AI-written patch?