---
"@type": Article
"@id": "https://helloloam.dev/principles/mcp-with-a-trust-model"
"@source": "https://helloloam.dev/data/article/mcp-with-a-trust-model.json"
"@stamp": "2026-10-22T21:53:55+00:00"
about:
  "@type": DefinedTerm
  "@id": "https://helloloam.dev/data/definedterm/mcp-with-a-trust-model.json"
  name: MCP with a trust model
  identifier: mcp-with-a-trust-model
  inDefinedTermSet:
    "@type": DefinedTermSet
    "@id": "https://helloloam.dev/data/definedtermset/gives-any-site.json"
    name: Gives any site
    identifier: gives-any-site
author: {"@id":"https://helloloam.dev/#organization"}
datePublished: "2026-10-03"
description: Bring any agent through the MCP. It presents a key, every verb is checked against that key's rights, and every change is staged, judged and written down.
headline: MCP with a trust model
identifier: mcp-with-a-trust-model
inLanguage: en
publisher: {"@id":"https://helloloam.dev/#organization"}
url: "https://helloloam.dev/principles/mcp-with-a-trust-model"
---

# MCP with a trust model

## One door for every agent

An agent that cannot open a shell still needs a way in. Loam gives it one door: the MCP, the protocol Claude and other assistants speak. No home-grown API and [no admin panel](/principles/no-dashboards) behind it — the same files underneath, with the rights, limits and history a door needs. The same door also speaks plain JSON and describes itself in OpenAPI, for tools that prefer those.

## A key per actor

The agent presents a key; the site holds only its fingerprint. Rights are checked per verb and per kind of file, so the same agent can do more on one site than on another — and a refusal names the right that was missing.

## Nothing goes straight in

Every write lands in a holding area first. There it is judged against what may exist in the site, then against the site's plan, and [only then does it become a draft](/principles/draft-and-live-lifecycle). Publishing runs the full check over the site as it would be. One change of layer runs at a time, so two agents can never each pass a check that together breaks the site.

## A small, honest vocabulary

The whole management surface is a short list of verbs: read a file or a folder, search, look at what is staged and at the difference, create or update a draft, upload a file, publish, take back, drop — plus the journal and the inbox for whoever may read them, and the plan — read by whoever may, set only by the owner. Destructive steps are deliberate: taking something back is never bulk. And the MCP does nothing it does not say: no shell, no fetching web pages, no editing an image in place.

## Answers an agent can act on

Every reply has the same envelope: did it work, a code from a closed set, the data, and what to do next. A verb called without its target does not fail — it answers with the map and the next step. An agent never has to guess what happened, or what to try now.

## The manual through the same door

An agent reads how loam works through the MCP — the documentation that travels with the engine it is talking to, so it always matches the version the site runs. The site's own rules sit beside it, in the guide. Every change ends as a line in the journal: what was done, by which key, and what was asked, in the caller's words. Repeated failed attempts from one address are slowed down, so guessing a key is impractical.

## What it costs

The trust is in the key, and in the account behind the agent that holds it: whoever can use your agent can use its key. Keep keys to the least rights that do the job, rotate them, and drop them the day someone leaves. And the MCP does only what it says: no shell, no fetching of web pages for you, no editing an image in place.