Jul 2025
Replit wiped a live database
During an explicit code freeze, the agent deleted production data, then claimed rollback was impossible. The CEO called it unacceptable and said it should never be possible.
For engineering leadership
The control plane between coding agents and live production
Direct MCP puts the model on the same side of the keys as production. Tzero lets the agent look at agent speed, and a human has to kick anything that can take the site down.
The tempting move
Point the IDE at cloud MCP. It looks like the future.
MCP adoption has either not been there, or it has been unsafe. The hallway demo is why people try. The trust model is why security turns it off.
What you get
Tools appear. Context-switching stops.
The agent talks to logs, tickets, and cloud APIs from the editor. One config file. It demos cleanly in a hallway.
What you assume
“The model will be careful.”
Natural-language freezes, project rules, and confirm dialogs are not a control plane. They are vibes with a UI.
What that wire actually is
IDE / harness
Holds or inherits the keys
The agent can call anything the token can.
MCP →↓ MCP
Cloud / tools
Production surface
DB, IAM, tickets, shell. Same session. Same token.
There is no default split between “look at prod” and “take the site down.” The actor is the same model that just invented a fix.
Apr 2026
Nine seconds. One volume delete.
Cursor and Claude Opus 4.6 deleted PocketOS’s production Railway volume in a single API call. A staging mismatch led the agent to a broadly scoped token.
MCP itself
Tool poisoning is demonstrated
Malicious instructions hide in tool descriptions the model sees and people often do not. One bad server can rewrite how trusted tools behave. Sandboxing that server does not stop it.
Private
Only the person in the IDE sees the tool calls. On-call finds out after production moves.
Unbounded
Read and mutate share one token path. “Don’t delete” lost to Replit and PocketOS alike.
Fragmented
Each MCP server is its own trust island. Policy does not compose across them. Secrets land in the config next to the model.
Direct MCP is agent access. The question is whether you can leave that access on during a SEV.
What “allowed” requires
A control plane on the tool path. A smarter model will not do this.
Harness
No token
Tool calls only. The IDE is not a key store.
→
Tzero
Keys and policy
Read fast. Mutate only after a human kick. Full audit on both legs.
→
Your systems
Dialer beside prod
It dials out. Tools have no public MCP URL.
Harness → Tzero → dialer beside prod
Universal harnesses
Cursor, Claude Code, Copilot, or a custom runner. Same tool path. The harness calls tools. It does not hold production keys.
Dialer
A process in your environment dials out to the control plane. Cloud credentials stay there. The IDE never receives them.
Custom OAuth
Sign-in is your IdP. The cloud token stays at the control plane. What the harness holds is a session, not the keys in mcp.json.
Full audit
Every tool call is recorded on both legs. On-call watches the same session live, instead of finding out after production moves.
Read fast. Kick slow.
Look-and-learn stays at agent speed. Anything that can take the site down waits for a human.
Self-hosted
The dialer runs in your tenant, beside the on-call and cloud stack you already have.
Why now
AI IDEs shipped tool access before a control plane existed. Teams that skipped MCP still paste logs into chat during a SEV. Teams that wired it left a non-deterministic actor holding a production token. Someone has to own that gap.
Where the direct wire fails
AI coding tools
They accelerate the patch. They do not govern the live system the patch touches.
VPN and network access
Built for a human on the network. A laptop on 10.x is not a verb-level audit of an agent.
Incident tools
They page and coordinate. They do not give the agent eyes from the checkout.
Direct IDE → MCP
The tempting default. Private session, one token for read and mutate, policy stuck to each server. Tzero is the path that lets you leave agent access on during a SEV.
Who this is for
Engineering teams with real cloud production and an on-call rotation, adopting AI IDEs, who will not leave a production token in the harness.
We're early
Tzero is pre-GA. We have no customers yet.
If you already run hardened MCP with a real read/write split, approval on mutate, and a live session security has signed off — you may not need this. Most shops do not. We are building with design partners. No fake metrics, no fake logos.
Design partners
Worth one staging SEV: a live read-only look from the IDE, a blocked restart, then a second human approves.
contact@framez.ai