A permission classifier cannot decide whether an MCP call is safe by studying its name and an empty set of arguments. Yet that was the public failure Qwen Code describes in its MCP classifier merge: each discovered MCP tool reached AUTO mode as an empty object, so the system often blocked the call on name alone. The resulting pressure was perverse. Users who needed a legitimate tool could write broad allow rules that skipped the classifier entirely.
The repair is not “send everything to the model.” Qwen Code now projects a server name, tool name, self-reported annotations, and a bounded copy of the proposed arguments. The public merged pull request links Claude Code sessions for the work; that is evidence of coding-agent participation in the documented change, not a way to assign every line to an agent. The engineering worth copying is in how the team turns a messy tool request into a smaller policy object without pretending the missing pieces were never there.
A blank form pushed users toward a master key
The AUTO-mode reference now says why arguments matter: an external-write or data-exfiltration rule cannot be applied to a tool name alone. But it also refuses a more comforting fiction. Server annotations such as read-only or idempotent hints are self-reported, and the classifier cannot see what a server will actually do. A benign-looking request can still conceal a harmful behavior on the other side of the MCP boundary.
The useful work is accounting for the loss
The inspected projection module limits strings, names, nesting, entries, and the total serialized form handed to the classifier. It marks cuts in place and raises truncation flags so a partial argument list cannot masquerade as a genuinely empty one. It also avoids a dangerous fallback: when an MCP server has disappeared from the registry or the projection fails, the code returns the conservative MCP form instead of forwarding raw historical arguments.
The matching projection tests are the real receipt of craft. They exercise adversarial object keys, budget accounting in the rendered form, malformed values, annotation filtering, and markers for omitted material. That is engineering depth a simple token cap would miss: the object that policy sees is itself an interface, so its bytes, labels, and failure modes need a contract.
The transferable skill: budget the review view
When a safety, approval, or review model must inspect a complicated request, build a projection rather than a dump. Set limits on the rendered representation, not only on source fields; reserve room for loss markers; distinguish absent data from clipped data; treat producer hints as untrusted; and fail closed when the source object cannot be resolved. Then test the weird keys, deep objects, stale history, and recovery paths that a happy-path schema will not reveal.
There is a fair cost to this design. The bounded view still does not prove server behavior, and forwarding arguments can be the wrong disclosure choice if a classifier runs at another provider. Qwen Code retains a name-only opt-out for that case, expecting more conservative blocks. The receipts are merged source and tests, not release or production evidence. The next useful signal is a public end-to-end evaluation showing how often the projection avoids needless blocks without widening the path for a malicious MCP server.