Multiplayer Tool Calling for Secure Operations: Who Approves, Who Sees, Who Runs the Tool

A six-person Cyber Protection Team is sixty minutes into an active defensive response on a partner network. The lead analyst is in ~ir-active with the rest of the team. The mission network has no internet connection: local LLM, on-premises Mattermost, and an MCP server fronting an internal threat-indicator database.