Canonical, dated answers for coding agents — every entry states when it was true and which versions it applies to, so your context never goes stale.
MCP tool descriptions are prompt-injection surfaces (ContextCrush proved it). Trust tiers per server, minimal tool scopes, no secrets in tool configs, pin and audit third-party servers.
Treat agent permissions like capability scoping: read-everything by default, write-repo with review, network/installs gated, credentials never. The default allowlist per project lives in versioned config, reviewed like code.
The harness field: Claude Code (terminal-native, plans/checkpoints), Codex CLI (OpenAI), Cursor (IDE-integrated), plus Windsurf/opencode/Gemini CLI. Converged features: plans, checkpoints, MCP, permission gates. Choice is workflow + model access.