The safety model

mcidrac gives a language model tools that can power-cycle hosts, rewrite BIOS, and import RAID-touching configuration. The safety model is layered, and it’s worth knowing exactly which layer does what.

Layer 1: MCP annotations + your client

Every tool declares honest MCP annotations. The destructive set — idrac_power, idrac_bios_set, idrac_scp_import, idrac_boot_to_iso, idrac_sel_clear, idrac_attributes_set — carries destructiveHint, and well-behaved clients (Claude Code included) prompt before running them. Read-only tools are annotated as such and are safe to allowlist.

There is deliberately no write gating inside the server — no confirm tokens, no read-only mode flag. The permission prompt belongs in the client, where the human is; duplicating it in the server would train operators to click through two dialogs instead of one.

Layer 2: guardrails against the probable accidents

Where a mistake is likely and catastrophic, the server refuses rather than trusts:

• Wrong-box SCP import: an SCP records its source service tag, and imports are refused when it doesn’t match the target — because a RAID section applied to the wrong box rebuilds (wipes) arrays. Deliberate clones require allow_cross_import=true.
• Malformed SCP: anything that isn’t a SystemConfiguration document is rejected before touching the BMC — passing the whole export result instead of its scp member is the classic slip.
• Unsupported power operations: validated against the firmware’s advertised allowable list before posting.
• Unverified boot config: idrac_boot_to_iso will not restart the host until the boot-once attributes read back correct.

Layer 3: honesty as a safety property

An LLM’s next action is only as good as the last tool result, so verify-by-read-back is itself a safety layer: partial instead of a false applied, step ledgers on mid-workflow failures, an error instead of “clean log” when the SEL count is unreadable, and destructive tools echoing host and service tag so a wrong-target call is visible in the transcript before the follow-up command.

What the model does not protect against

Be clear-eyed about the boundaries. mcidrac will faithfully execute a confirmed bad decision — it refuses accidents, not intentions. The HTTP transport has no authentication; network reachability is authorization, so bind to localhost or a trusted network. Registry credentials grant the server full iDRAC privilege; there are no per-tool credential scopes. And there is no firmware-update tool at all — that’s a deliberate absence (“flag, don’t flash”), because a half-applied firmware update is the one mistake on this list with no undo.