Microsoft Teams
Microsoft Teams reaches an agent through an MCP server, so the seam is the proxy. It sees every tool call before the server runs it, and every result on the way back, which is also where content trying to become an instruction gets caught.
What the proxy sees
mcp.microsoft-teams.*
Every tool the server publishes, matched by name, with its arguments. One wrap covers Claude Code, Claude Desktop, Cursor, Cline, VS Code and OpenClaw at once, plus the project file a swarm registers itself in, because it stands in front of the server rather than inside any of them.
What it cannot see
- The model's reasoning.
- Anything the agent does without calling a tool.
- The server's own side effects, once a call has been allowed through.
Declared rather than implied. A governed agent with an unwatched side channel is worse than an ungoverned one.
The rule this writes
[[rules]] name = "microsoft-teams-writes-ask-first" match.actions = ["mcp.microsoft-teams.*"] decision.effect = "ask" decision.reason = "A change here is somebody's to approve."
Run npx memnox to find out whether Microsoft Teams is actually reachable from your machine. It reads your own disk and needs no account.