接外部 · 接一个真数据源,完成一次查询Reach Out · Connect One Real Data Source, Run One Query.
agent 默认只看得见你的终端。这章真的接上一个外部数据源 —— 一个只读的 GitHub MCP —— 用它回答一个光看终端答不了的问题,然后把权限收成只读。能连是接口给的能力,该连是你给的判断,红线本章划清。By default the agent only sees your terminal. This chapter actually connects one external data source — a read-only GitHub MCP — uses it to answer a question the terminal alone can't, then locks it down to read-only. Can-connect is the interface's gift; should-connect is your call, and this chapter draws the line.
到这里,agent 看得见的还只是你的终端和仓库。但你大半上下文不在那儿 —— 在 issue 跟踪、数据库、监控面板、内部 API 里。MCP(Model Context Protocol)是那根接线。这章不空谈接线图:真的接一个只读的 GitHub MCP,用它回答一个光看终端答不了的问题,然后把权限收成只读。接完这一次,你就有了判断「下一个该不该接」的全部手感。By here, all the agent sees is still your terminal and repo. But most of your context isn't there — it's in issue trackers, databases, monitoring dashboards, internal APIs. MCP (the Model Context Protocol) is the wire. This chapter doesn't talk wiring diagrams: we actually connect one read-only GitHub MCP, use it to answer a question the terminal alone can't, then lock it down to read-only. After this one pass, you'll have all the feel you need to judge the next 'should I connect this.'
— I
主线:接一次只读 GitHub MCP,答一题,收权限The Main Line: Connect One Read-Only GitHub MCP, Answer One Question, Lock It Down.
为什么选 GitHub:几乎人人都有,只读 token 好申请,答错了代价为零。问题也挑一个终端答不了的:「我们 repo 里,open 超过 30 天、最近一周还有人评论的 issue 有哪些?」—— 答案不在你的文件系统里,在 GitHub 的 API 后面。1注 1Note 1Warp Docs · Model Context Protocol (MCP) —— 截至 2026-08-06:MCP servers 用标准接口给 Warp 本地 agent 暴露工具和数据源;支持 CLI command server 与 Streamable HTTP / SSE URL server、自定义 headers、环境变量;入口:Settings > Agents > MCP servers、Drive Personal > MCP Servers、命令面板「Open MCP Servers」;OAuth 服务器首次启动弹授权窗;2026-07-31 起,工具确认面板会显示正在运行的是哪个 tool、来自哪个 server。Warp Docs · Model Context Protocol (MCP) — as of 2026-08-06: MCP servers expose tools and data sources to Warp local agents through a standard interface; CLI command servers and Streamable HTTP / SSE URL servers, custom headers, and env vars supported; entry points: Settings > Agents > MCP servers, Drive Personal > MCP Servers, the palette's 'Open MCP Servers'; OAuth servers show an auth modal on first spawn; since 2026-07-31, tool confirmations show which tool is running and from which server.Why GitHub: nearly everyone has it, read-only tokens are easy to get, and a wrong answer costs nothing. The question is also one the terminal can't answer: 'which issues in our repo have been open over 30 days but still got a comment this week?' — the answer isn't in your filesystem; it's behind GitHub's API.1注 1Note 1Warp Docs · Model Context Protocol (MCP) —— 截至 2026-08-06:MCP servers 用标准接口给 Warp 本地 agent 暴露工具和数据源;支持 CLI command server 与 Streamable HTTP / SSE URL server、自定义 headers、环境变量;入口:Settings > Agents > MCP servers、Drive Personal > MCP Servers、命令面板「Open MCP Servers」;OAuth 服务器首次启动弹授权窗;2026-07-31 起,工具确认面板会显示正在运行的是哪个 tool、来自哪个 server。Warp Docs · Model Context Protocol (MCP) — as of 2026-08-06: MCP servers expose tools and data sources to Warp local agents through a standard interface; CLI command servers and Streamable HTTP / SSE URL servers, custom headers, and env vars supported; entry points: Settings > Agents > MCP servers, Drive Personal > MCP Servers, the palette's 'Open MCP Servers'; OAuth servers show an auth modal on first spawn; since 2026-07-31, tool confirmations show which tool is running and from which server.
01
接:Settings > Agents > MCP servers 加一个 GitHub serverConnect: add a GitHub server under Settings > Agents > MCP servers
入口有三个:Settings > Agents > MCP servers、Drive 的 Personal > MCP Servers、命令面板搜 Open MCP Servers。用 GitHub 官方 MCP,token 只给只读 scope;OAuth 类的服务器首次启动会弹授权窗,授权完才上线。加完不用重启 Warp —— 下一条消息新工具就进上下文。1注 1Note 1Warp Docs · Model Context Protocol (MCP) —— 截至 2026-08-06:MCP servers 用标准接口给 Warp 本地 agent 暴露工具和数据源;支持 CLI command server 与 Streamable HTTP / SSE URL server、自定义 headers、环境变量;入口:Settings > Agents > MCP servers、Drive Personal > MCP Servers、命令面板「Open MCP Servers」;OAuth 服务器首次启动弹授权窗;2026-07-31 起,工具确认面板会显示正在运行的是哪个 tool、来自哪个 server。Warp Docs · Model Context Protocol (MCP) — as of 2026-08-06: MCP servers expose tools and data sources to Warp local agents through a standard interface; CLI command servers and Streamable HTTP / SSE URL servers, custom headers, and env vars supported; entry points: Settings > Agents > MCP servers, Drive Personal > MCP Servers, the palette's 'Open MCP Servers'; OAuth servers show an auth modal on first spawn; since 2026-07-31, tool confirmations show which tool is running and from which server.There are three entry points: Settings > Agents > MCP servers, Drive's Personal > MCP Servers, or search Open MCP Servers in the palette. Use GitHub's official MCP with a read-only-scoped token; OAuth servers show an auth modal on first spawn and come online after you authorize. No Warp restart needed — the next message folds the new tools into context.1注 1Note 1Warp Docs · Model Context Protocol (MCP) —— 截至 2026-08-06:MCP servers 用标准接口给 Warp 本地 agent 暴露工具和数据源;支持 CLI command server 与 Streamable HTTP / SSE URL server、自定义 headers、环境变量;入口:Settings > Agents > MCP servers、Drive Personal > MCP Servers、命令面板「Open MCP Servers」;OAuth 服务器首次启动弹授权窗;2026-07-31 起,工具确认面板会显示正在运行的是哪个 tool、来自哪个 server。Warp Docs · Model Context Protocol (MCP) — as of 2026-08-06: MCP servers expose tools and data sources to Warp local agents through a standard interface; CLI command servers and Streamable HTTP / SSE URL servers, custom headers, and env vars supported; entry points: Settings > Agents > MCP servers, Drive Personal > MCP Servers, the palette's 'Open MCP Servers'; OAuth servers show an auth modal on first spawn; since 2026-07-31, tool confirmations show which tool is running and from which server.
02
问:把那句话交给它Ask: hand it the question
⌘↩ 开会话,贴上下面 PromptBox 示例 tab 那段。注意它要求 agent 说出用了哪个 tool、数据来自哪 —— 这是防「凭空编」的验收钩子。⌘↩ to open a conversation, paste the sentence from the Example tab below. Note it requires the agent to name the tool it used and where the data came from — that's the acceptance hook against fabrication.
03
验:看它真读了外部数据Verify: watch it actually read external data
它调用 MCP 工具时,确认面板会显示正在跑的是哪个 tool、来自哪个 server —— 你看得见它碰的是 GitHub 而不是在猜。答案回来,抽查两个 issue 号去 GitHub 上核对:真实存在、日期对得上,才算这次接线成功。1注 1Note 1Warp Docs · Model Context Protocol (MCP) —— 截至 2026-08-06:MCP servers 用标准接口给 Warp 本地 agent 暴露工具和数据源;支持 CLI command server 与 Streamable HTTP / SSE URL server、自定义 headers、环境变量;入口:Settings > Agents > MCP servers、Drive Personal > MCP Servers、命令面板「Open MCP Servers」;OAuth 服务器首次启动弹授权窗;2026-07-31 起,工具确认面板会显示正在运行的是哪个 tool、来自哪个 server。Warp Docs · Model Context Protocol (MCP) — as of 2026-08-06: MCP servers expose tools and data sources to Warp local agents through a standard interface; CLI command servers and Streamable HTTP / SSE URL servers, custom headers, and env vars supported; entry points: Settings > Agents > MCP servers, Drive Personal > MCP Servers, the palette's 'Open MCP Servers'; OAuth servers show an auth modal on first spawn; since 2026-07-31, tool confirmations show which tool is running and from which server.When it calls an MCP tool, the confirmation panel shows which tool is running and from which server — you can see it touching GitHub rather than guessing. When the answer comes back, spot-check two issue numbers on GitHub: they really exist and the dates line up — only then is the wiring proven.1注 1Note 1Warp Docs · Model Context Protocol (MCP) —— 截至 2026-08-06:MCP servers 用标准接口给 Warp 本地 agent 暴露工具和数据源;支持 CLI command server 与 Streamable HTTP / SSE URL server、自定义 headers、环境变量;入口:Settings > Agents > MCP servers、Drive Personal > MCP Servers、命令面板「Open MCP Servers」;OAuth 服务器首次启动弹授权窗;2026-07-31 起,工具确认面板会显示正在运行的是哪个 tool、来自哪个 server。Warp Docs · Model Context Protocol (MCP) — as of 2026-08-06: MCP servers expose tools and data sources to Warp local agents through a standard interface; CLI command servers and Streamable HTTP / SSE URL servers, custom headers, and env vars supported; entry points: Settings > Agents > MCP servers, Drive Personal > MCP Servers, the palette's 'Open MCP Servers'; OAuth servers show an auth modal on first spawn; since 2026-07-31, tool confirmations show which tool is running and from which server.
04
收:权限锁成只读Lock: permissions down to read-only
回到 MCP 设置,把这个 server 的写类工具(create_issue、add_comment 之类)放进 denylist —— denylist 优先于一切,命中必须人工批准。以后它只能读,想写得先过你。这一步就是「能连」和「该连」之间的那道闸。3注 3Note 3Warp Docs · Agent Profiles & Permissions —— 可针对每个 MCP 服务器选择「Agent decides」、allowlist 或 denylist;denylist 优先于 allowlist 与「Agent decides」,命中必须人工批准(详见第八章「管住它」)。Warp Docs · Agent Profiles & Permissions — for each MCP server you can choose 'Agent decides,' allowlist, or denylist; the denylist takes precedence over both the allowlist and 'Agent decides,' and a match always requires manual approval (see chapter 8, Keep It in Check).Back in the MCP settings, put this server's write tools (create_issue, add_comment, and friends) on the denylist — the denylist outranks everything, and a match always requires manual approval. From now on it can only read; writing goes through you. This step is the gate between 'can connect' and 'should connect.'3注 3Note 3Warp Docs · Agent Profiles & Permissions —— 可针对每个 MCP 服务器选择「Agent decides」、allowlist 或 denylist;denylist 优先于 allowlist 与「Agent decides」,命中必须人工批准(详见第八章「管住它」)。Warp Docs · Agent Profiles & Permissions — for each MCP server you can choose 'Agent decides,' allowlist, or denylist; the denylist takes precedence over both the allowlist and 'Agent decides,' and a match always requires manual approval (see chapter 8, Keep It in Check).
提示词Prompt主线同款:一个光看终端答不了的问题The main line's own: a question the terminal can't answer
用 GitHub MCP 回答:<repo> 里 open 超过 <天数> 天、
最近 <天数> 天内还有人评论的 issue 有哪些?
要求:
1. 说明你调用了哪个 tool、数据来自哪里;
2. 列出 issue 号、标题、open 天数、最近评论时间;
3. 只读,不要创建或修改任何 issue / comment。Using the GitHub MCP, answer: in <repo>, which issues have been open
over <days> days but still got a comment in the last <days> days?
Requirements:
1. State which tool you called and where the data came from;
2. List issue number, title, days open, last comment time;
3. Read-only — do not create or modify any issue / comment.
用 GitHub MCP 回答:我们 repo 里 open 超过 30 天、
最近 7 天内还有人评论的 issue 有哪些?
要求:
1. 说明你调用了哪个 tool、数据来自哪里;
2. 列出 issue 号、标题、open 天数、最近评论时间;
3. 只读,不要创建或修改任何 issue / comment。Using the GitHub MCP, answer: in our repo, which issues have been open
over 30 days but still got a comment in the last 7 days?
Requirements:
1. State which tool you called and where the data came from;
2. List issue number, title, days open, last comment time;
3. Read-only — do not create or modify any issue / comment.
没有 MCP 的同一题The same question without MCP
开浏览器,进 Issues 页,按 updated 排序,一页页翻;open 天数要心算,最近评论要逐个 issue 点进去看;二十分钟后你有一份「大概齐」的清单,漏没漏你没把握。Open the browser, go to the Issues page, sort by updated, flip pages; days-open is mental math, last-comment means clicking into every issue; twenty minutes later you have a 'roughly right' list and no confidence in what you missed.
刚才这三分钟The three minutes you just had
一句话,一张带 issue 号和日期的表,工具调用过程全程可见,你抽查了两个号都对。剩下的问题是判断:这些僵尸 issue 哪些该关 —— 那是你的活,agent 把找答案的活干完了。One sentence, a table with issue numbers and dates, the tool calls visible the whole way, two spot-checks both correct. The remaining question is judgment — which of these zombie issues to close — and that's your job; the agent finished the finding.
— II
它能读你已有的配置It Can Read Your Existing Configs.
你不必重新配一遍。Warp 认这些位置的 MCP 配置:自己的 ~/.warp/.mcp.json(全局)和项目里的 .warp/.mcp.json,Claude Code 的 ~/.claude.json / .mcp.json,Codex 的 ~/.codex/config.toml,以及其他 agent 的 ~/.agents/.mcp.json。auto-spawn 规则分三层:Warp 自己的全局 file-based servers 默认自动启动;第三方全局 servers 要你显式打开「Auto-spawn servers from third-party agents」;项目级 servers 永不自动启动,会话级生效,重启后要重新批准 —— 从陌生 repo clone 下来的 .warp/.mcp.json 不能自己启动本地命令,这条规则是你的保险。2注 2Note 2Warp Docs · MCP security behavior —— 全局 Warp file-based servers 默认 auto-spawn;第三方全局 servers 需显式开启「Auto-spawn servers from third-party agents」;项目级 servers 永不自动启动、会话级生效(重启后重新批准);MCP 配置编辑需要批准;共享时 env 值会被 scrub,队友各自重填;日志可能含 token,分享前先清理;相对路径命令要显式设 working_directory。Warp Docs · MCP security behavior — global Warp file-based servers auto-spawn by default; third-party global servers require the explicit 'Auto-spawn servers from third-party agents' toggle; project-scoped servers never auto-spawn and are session-scoped (re-approved after restart); MCP config edits require approval; sharing scrubs env values so teammates re-enter their own; logs can contain tokens — scrub before sharing; set working_directory explicitly for relative commands.You don't reconfigure from scratch. Warp recognizes MCP configs in these places: its own ~/.warp/.mcp.json (global) and the project's .warp/.mcp.json, Claude Code's ~/.claude.json / .mcp.json, Codex's ~/.codex/config.toml, and other agents' ~/.agents/.mcp.json. Auto-spawn rules come in three layers: Warp's own global file-based servers auto-start by default; third-party global servers need the explicit 'Auto-spawn servers from third-party agents' toggle; project-scoped servers never auto-start — they're session-scoped and re-approved after restart, so a cloned repo's .warp/.mcp.json can't silently launch local commands. That rule is your insurance.2注 2Note 2Warp Docs · MCP security behavior —— 全局 Warp file-based servers 默认 auto-spawn;第三方全局 servers 需显式开启「Auto-spawn servers from third-party agents」;项目级 servers 永不自动启动、会话级生效(重启后重新批准);MCP 配置编辑需要批准;共享时 env 值会被 scrub,队友各自重填;日志可能含 token,分享前先清理;相对路径命令要显式设 working_directory。Warp Docs · MCP security behavior — global Warp file-based servers auto-spawn by default; third-party global servers require the explicit 'Auto-spawn servers from third-party agents' toggle; project-scoped servers never auto-spawn and are session-scoped (re-approved after restart); MCP config edits require approval; sharing scrubs env values so teammates re-enter their own; logs can contain tokens — scrub before sharing; set working_directory explicitly for relative commands.
一个只读 MCP 服务器条目(CLI 型,示意;包名与参数以对应 server 文档为准)A read-only MCP server entry (CLI type, illustrative; package and args per the server's own docs)
提示词PromptMCP 接入审查模板(接下一个之前先跑这个)MCP connection review template (run this before the next one)
我要给 Warp Agent 接一个 MCP server:<server-name>。
先不要安装或启动。
请帮我审查:
1. 它能读什么;
2. 它能写什么;
3. 凭据放在哪里,能否撤销;
4. 日志在哪里,是否可能含 token;
5. 该设为 allowlist、Agent decides 还是 denylist;
6. 第一次只读验证问题应该问什么。I want to connect an MCP server to Warp Agent: <server-name>.
Do not install or start it yet.
Review:
1. what it can read;
2. what it can write;
3. where credentials live and how they can be revoked;
4. where logs live and whether they can contain tokens;
5. whether to set allowlist, Agent decides, or denylist;
6. the first read-only verification question to ask.
我要给 Warp Agent 接一个 MCP server:linear-mcp。
先不要安装或启动。
请帮我审查:
1. 它能读什么;
2. 它能写什么;
3. 凭据放在哪里,能否撤销;
4. 日志在哪里,是否可能含 token;
5. 该设为 allowlist、Agent decides 还是 denylist;
6. 第一次只读验证问题应该问什么。I want to connect an MCP server to Warp Agent: linear-mcp.
Do not install or start it yet.
Review:
1. what it can read;
2. what it can write;
3. where credentials live and how they can be revoked;
4. where logs live and whether they can contain tokens;
5. whether to set allowlist, Agent decides, or denylist;
6. the first read-only verification question to ask.
— III
能连不等于该连Can-Connect Isn't Should-Connect.
每多接一个 MCP 服务器,agent 能做的事变多,能闯的祸也变多。三笔代价要算:多一个外部依赖就多一份攻击面,多一组工具就多烧 token,多一处写权限就多一处它能改坏的地方。所以默认连只读,写权限单独想清楚 —— denylist 优先于 allowlist 与「Agent decides」,命中必须人工批准,生产库的写口就该进 denylist。3注 3Note 3Warp Docs · Agent Profiles & Permissions —— 可针对每个 MCP 服务器选择「Agent decides」、allowlist 或 denylist;denylist 优先于 allowlist 与「Agent decides」,命中必须人工批准(详见第八章「管住它」)。Warp Docs · Agent Profiles & Permissions — for each MCP server you can choose 'Agent decides,' allowlist, or denylist; the denylist takes precedence over both the allowlist and 'Agent decides,' and a match always requires manual approval (see chapter 8, Keep It in Check).连之前先问三句:这服务器要的权限是只读还是能写?它的工具会不会把敏感数据带出去?这件事我多久用一次、值不值得让它常驻?「能连」是接口给的能力,「该连」是你给的判断。Every MCP server you add widens what the agent can do — and what it can break. Three costs to count: each external dependency is more attack surface, each tool set burns more tokens, each write permission is one more place it can damage. So connect read-only by default and think write access through separately — the denylist takes precedence over both the allowlist and 'Agent decides,' a match always requires manual approval, and a prod database's write path belongs on it.3注 3Note 3Warp Docs · Agent Profiles & Permissions —— 可针对每个 MCP 服务器选择「Agent decides」、allowlist 或 denylist;denylist 优先于 allowlist 与「Agent decides」,命中必须人工批准(详见第八章「管住它」)。Warp Docs · Agent Profiles & Permissions — for each MCP server you can choose 'Agent decides,' allowlist, or denylist; the denylist takes precedence over both the allowlist and 'Agent decides,' and a match always requires manual approval (see chapter 8, Keep It in Check). Before connecting, ask three things: read-only or write? could its tools carry sensitive data out? how often do I use this, and is it worth keeping resident? 'Can connect' is the capability the interface gives; 'should connect' is the judgment you give.
