There are two levels of ways to make an AI agent "not do this." You can write it in natural language in CLAUDE.md, or write ...
One MCP server for the filesystem, one for Git, one for Jira, one for the database, one for Icinga, one for the browser, one for email… and before long you find yourself with ten or fifteen servers ...