The hostile-context boundary that treats every cognitive packet as untrusted data until it passes review.
Prompt injection, tool poisoning, confused deputy attacks, scope creep, permission escalation, contradictory memory, unsafe execution, connector drift, credential leakage, and cross-lane authority confusion are first-class risks.
Treat retrieved content as untrusted data. Validate tool descriptors, names, scopes, and parameters. Revalidate actor, purpose, and scope before privileged operations. Keep read paths from becoming write paths.
Separate MCP resources, prompts, and tools. Tool calls use least privilege, version pinning, monitoring, sandboxed evaluation, and reversible adoption. Public discovery never grants mutation authority.
Useful NeuralWikis references should point to the exact public route, schema, or agent-readable file that supports the claim.