Secure-by-Default Guardrails for MCP-Based Tool Use in Multi-Modal LLM Agents

As Large Language Models (LLMs) proliferate, fragmented interfaces across multiple providers create friction for developers. More critically, the rise of autonomous agents and protocols such as the Model Context Protocol (MCP) expands the attack surface by enabling tool execution and access to local or remote resources. This paper presents llm-cli, a unified command-line interface that harmonizes interactions with multiple LLM providers while providing secure-by-default guardrails for agentic tool use. llm-cli combines (i) a plugin-based tool registry with an explicit human-readable explanation field for each tool call, (ii) role-based restrictions for unauthenticated clients (e.g., guest read-only access), and (iii) runtime validation for command execution and file-path access. We discuss practical threat scenarios such as prompt injection and privilege misuse, and show how layered controls-policy checks, input validation, and human-in-the-loop approval-reduce the risk of unsafe tool execution in real-world workflows.