Guardrails belong in the server
A model can be talked out of a rule, so the checks live in server code. The argument, then the lab built to test it.
- Part 1 Why does my MCP server call the tool I told it never to call? The system prompt is advice to the model. Nothing between the model and the API ever reads it, so the checks have to live in code.
- Part 2 If the model refused the attack, why isn't the server safe? A refusal is the model's call, and the model's call can change. mcploitable is a lab of deliberately vulnerable MCP servers built to show where that stops mattering: 105 attempts at the correct control, zero through.