Untrusted content will influence the model, so the execution system must limit what that influence can achieve: what prompt injection, permissions and approvals, sandboxes, credentials, and MCP authorization each cover.
Separate local and remote responsibilities, understand connection layers, and verify the correct server before changing it.
Python subprocess invocation, output, timeouts, environments, shell boundaries, and process lifecycle.
Distinguish user and host keys, then disable password and root login with a multi-session safety procedure.
Stage temporary and interface-specific rules, verify fresh connections, and then remove public SSH safely.