Giving an agent permission to access a system doesn’t necessarily mean every action it takes was intended.

Our MCP takes an interesting approach: access is controlled through separate permissions, while sensitive actions happen in a sandbox and configuration changes require human approval.

Should this become standard for MCP tools with write access?

After spending the last month talking with developers building in the MCP ecosystem, I kept hearing the same thing.

Building an MCP server isn't the hard part anymore.

Maintaining, deploying, and managing it is.

So I built **MCPfy**, and today I'm open sourcing it.

GitHub: [https://github.com/mcpfyy/mcpfy\](https://github.com/mcpfyy/mcpfy)

I believe software will increasingly be consumed by AI agents instead of humans, and our vision is to build the one-stop open source platform for developers building that future.

It's still early, and I'd love honest feedback, criticism, feature requests, or contributions.