Allow-list MCP servers before a company-wide rollout

Angie Jones, then VP of Engineering for AI Tools and Enablement at Block, described how the company rolled out its open-source Goose agent to all 12,000 employees in about eight weeks by gating MCP servers behind a security-reviewed allow-list enforced in the agent client. Block also scans shared prompt "recipes" for hidden Unicode format-control characters, requires human approval for tools marked destructive, and keeps multiple models available, with security reviewing even internally built servers before their IDs are added.

Refuse any MCP server that is not on a reviewed allow-list. The agent client checks that identity before it connects, and a server that misses the list does not install. Scan shared prompt packages for hidden format-control characters, require a person to approve tools annotated destructive, and keep more than one model available. Angie Jones https://chainofthought.show/guests/angie-jones/ , then VP of Engineering for AI Tools and Enablement at Block, walked through those controls in a January 2026 episode. Her team had rolled Goose, Block's open-source agent, out to all 12,000 Block employees in about eight weeks. Put the allow-list in the agent client and refuse any server that is not on it. At Block, Jones said, a server that isn't on the allowed list won't work. Block handles financial data, so employees could not install a random MCP server from GitHub. The protocol was new, and independent developers had already published thousands of servers. Early servers at Block were built for engineers, including GitHub. Requests then came in for Airtable, Workday, Snowflake, and Figma, and the team built more servers in-house. The agent will say nope. Can't install it. Angie Jones, then VP of Engineering for AI Tools and Enablement at Block, on Chain of Thought ep 48 https://chainofthought.show/podcast/48-how-block-deployed-ai-agents-to-12-000-employees-in-8-weeks-w-mcp-angie-jones/ Check the identity of the server the client is about to launch, not a display name. Add an ID only after security review, and remove it when the server should stop running; the next attempt fails the same check. Shared prompt packages need a scan before the client accepts them. Jones described recipes as a shared workflow: system instructions, a prompt, and MCP servers in one bundle. One finding from her red team: someone could hide invisible characters in that kind of packaged prompt. A file can look like a normal workflow and still carry characters a person will not see in a typical editor. Unicode category Cf is the format-control class, including zero-width characters. A strict policy is to reject the file if any character is in that class. That can catch legitimate text too some languages and emoji sequences use these characters , so treat it as one check alongside reviewing the recipe, not proof it's safe. A minimal sketch to adapt, not a drop-in library. python import unicodedata ALLOWED SERVERS = { "incidents.internal", "source.internal", } def connect server server id : if server id not in ALLOWED SERVERS: raise PermissionError f"refusing {server id}: not on the allow-list" def reject hidden controls prompt text : for char in prompt text: if unicodedata.category char == "Cf": raise ValueError "shared prompt contains a format-control character" Call reject hidden controls on the recipe text before the client accepts the package. Call connect server with the server ID before the client starts that server. An in-house server can still be wrong. Jones said the majority of servers on Block's list are ones they built, and that only a handful of official corporate servers are accepted from outside. Security reviews a server before its ID is added, including one written inside the company. even if I built one, security needs to review it to make sure I didn't miss something. ... everything is not intentionally malicious. Sometimes we just don't know The review is how an ID earns a place on the list. The same security team also builds guardrails against prompt injection into Block's AI products, and its red team is where the recipe finding came from: if I'm a malicious person, I put some invisible characters in there that's like, you know, doing not so nice things on your on your system. So treat a recipe as untrusted input, even one a coworker sends. If the scan fails, load none of it: not the instructions, the prompt, or the server list. Annotate tools that can change, edit, or delete, and require a person to approve those calls. Block doesn't do this per model. They annotate the tool as destructive, which she defined as able to change things, edit, or delete. The agent may run tools that are not destructive. A destructive tool has to ask first, show what it is trying to do, and wait for a yes or no. Reads stay automatic; writes and deletes wait. One addition of mine: if a tool has no annotation yet, treat it as destructive until someone classifies it. Leave the model choice open. Jones said no one has won this race yet. In any given week, the model people treat as best can come from a different provider, so locking in on one would be foolish. The models also have different strengths. Anthropic's models are the ones Block's engineers typically use for software development. Job functions that rely more on reasoning may want a GPT model. Block reaches those models through Databricks, which she described as a hosting service. She named Gemini models from Google, GPT models from OpenAI, and models from Anthropic. Local open-source models are an option too, but agentic work needs the larger models, so the engineers who use them upgraded their machines. She put that group at a very small percentage. Keep the allow-list, the recipe scan, and destructive-tool approval in the client. Those checks stay put whichever permitted model answers. What happens if an MCP server is not on the allow-list? The client refuses it. "The agent will say nope." A server is added only after security review. Do servers built in-house skip security review? No. Jones said even a server she built goes through security review, because not every problem is malicious; sometimes the author just missed something. Does everyone have to use the same model? No. Jones's view is that no one has won the model race yet, so locking in on one would be a mistake. Gemini, GPT, and Anthropic models are available through Databricks. She said only a very small percentage of engineers have upgraded their machines to run local open-source models. Cf . The full conversation, with the transcript, is on Chain of Thought https://chainofthought.show/podcast/48-how-block-deployed-ai-agents-to-12-000-employees-in-8-weeks-w-mcp-angie-jones/ . Subscribe to the Chain of Thought newsletter https://newsletter.chainofthought.show/subscribe?utm source=devto&utm medium=referral&utm campaign=newsletter for new episodes and write-ups like this one. Drafted with AI assistance from the episode transcripts.