Outcome. You can draw a tool-call data flow and identify who executes code, where credentials live, which data crosses boundaries, and who authorizes the action.
“Server-side” and “client-side” are useful implementation labels, but they do not by themselves answer the security questions. A provider may execute a built-in search tool. Your backend may execute a custom database function. A remote connector or MCP server may run in a third party’s cloud. A browser may perform a local action. Private systems can be exposed through OAuth, gateways, private networking, or connectors—so “the provider cannot access it by design” is not generally true once integrations are configured.
For every tool, map five things: executor, credential owner, data sent, authorization decision, and side effect. Then add logs, retention, network destinations, and failure paths. The model should receive the minimum result needed, not a full database row merely because the tool can fetch it.
Trust boundaries matter most when content from one zone can influence action in another. A malicious document retrieved from the web should not gain permission to invoke an internal write tool. Separate data from instructions, use least-privilege identities, and require confirmation for consequential cross-boundary actions.
Mental model. A tool is a data-and-authority path; draw the path before trusting the label attached to it.
Evidence trail — reviewed 23 July 2026. MCP host/client/server architecture: https://modelcontextprotocol.io/docs/learn/architecture. OWASP excessive-agency guidance: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/. Indirect prompt injection: https://arxiv.org/abs/2302.12173.
Draw: user mailbox → attachment parser → model provider → tool proposal → company gateway → CRM. Use a read-only identity for lookup and a scoped write identity for approved fields; strip secrets; treat email content as untrusted; require user confirmation for ownership/status changes; log data sent and the final CRM response.
A Claude-hosted tool, a client tool, and a remote MCP server can have different executors and credential paths. Map the actual product configuration.