The process.env inheritance is the cheapest fix here. Scrubbing the child env to an allowlist would cut the AWS, SSH and GitHub token exposure even when an injection lands. Question: is COMMON_DISCIPLINE enforced server-side in bare tool mode, or only when the client loads the full prompt? If it is client-side, splitting analyze_web_bundle and capture_process_scenario into separate servers would remove the shared context instead of relying on destructiveHint.