Blast radius: what your AI agent can destroy

The security question a solo builder actually faces is not only the app they ship. It is the blast radius of the agent holding their keys, and of the MCP servers, plugins, and skills they install on trust. Here is a verified incident ledger in both directions, every entry traced to a primary, each ending in one guardrail that maps to a documented feature.