Host gate around MCPClient tools before CodeAgent runs them?

[AffixIO]

Context

smolagents can pull MCP tools via MCPClient / ToolCollection.from_mcp into CodeAgent or ToolCallingAgent. Separately npm affixio@1.3.3 exports mcpToolGate and createAgentTrust for host-side allow/deny (+ optional enrol/attest) before a tool runs. Not a Hub Space listing. Not a new built-in tool.

Unique vs our MCP typescript-sdk client middleware post: this is the Python agent host that already adapted MCP tools, especially code-acting agents, not the protocol SDK itself. Aware CONTRIBUTING: core ships primitives, not integrations.

Ask

For a fail-closed third-party host gate around tools returned by MCPClient, is the preferred seat:

1. user-land wrapper / docs sketch only (publish on the Hub, not core)
2. a small documented extension point you want builders to use
3. out of scope for smolagents

Discovery only. No PR unless you want a docs sketch. Hub: https://hub.affix-io.com API: https://api.affix-io.com