Tyler Moore

Software engineer; sabbatical enthusiast; AI experimenter and practitioner

[Tyler Moore @tylermoore]

@CoachDanGo No garmin? 😅

[Tyler Moore @tylermoore]

NYC is loving the energy right now

[Tyler Moore @tylermoore]

As an aside, there’s probably some cool data that you can pull from flight staff across all the tail numbers you track that isn’t available from the common APIs with some lightweight incentives

[Tyler Moore @tylermoore]

@Flighty @rjonesy what are the odds you can start pulling plane wifi systems into view? E.g., does the plane have Starlink, Viasat, Thales, etc.?

[Tyler Moore @tylermoore]

@Austen Ballpark cost?

[Tyler Moore @tylermoore]

@businessbarista What are your favorite scheduled runs?

[Tyler Moore @tylermoore]

@swang_co Checkout solid state coffee on the UWS!

[Tyler Moore @tylermoore]

If you were to throw a large wrench into that exhaust, how long before it vaporizes? Does it have the slightest chance of making it to the other side even if completely deformed?

[Peter Beck @Peter_J_Beck]

for your enjoyment

[Tyler Moore @tylermoore]

@businessbarista AI-native

[Tyler Moore @tylermoore]

@firefliesai @krishramineni you've gotta figure out how to allow me to sign in w/o allowing access to my calendar. I don't want to give your system access to my data, but I need to sign in to access notes that your other users are trying to share with me. I'll create an account for AuthN/AuthZ, but you don't need access to my private calendar events for me to view something that's explicitly being shared with me.

[Tyler Moore @tylermoore]

@levie @FernandoCerenza Amazing. Looking forward to it!

[Tyler Moore @tylermoore]

@levie FYI - friction-y Box MCP use case: for folders shared with me, I can't use Box MCP to add files to them.

All I get is an error from the Box MCP: "The upload operation was blocked because the file is externally accessible", and under Box MCP Server settings in the console, there's nothing for me to toggle that would permit this.

Taking a look at documentation, this seems consistent with the current thinking around Box MCP security design: https://t.co/Vm3fUfaI9h.

It would be a killer use case for me to allow-list specific shared folders (or folders from trusted domains/emails). Right now, the only workaround is to have Claude write files locally and then move them over via Box Drive on my machine, ultimately syncing with the desired destination folder (clunky and gets around the security risk regardless).

Separately, would love the ability to edit Box Notes with Box MCP. I assume this is a bigger lift given the live collaboration overhead + proprietary format, but it would be another killer use case for me.

[Tyler Moore @tylermoore]

@SawyerMerritt Also potholes

[Tyler Moore @tylermoore]

@bcherny @trq212 — I would love a feature that allows you to broadly define what might be considered sensitive data in Claude when using MCP servers and have guardrails that either block or verify what can be shared at runtime with memory that improves general awareness and decision making over time.

[Tyler Moore @tylermoore]

AI security tip for anyone using MCP servers with Claude (especially official ones like the ZoomInfo connector/MCP):

The “FOR BEST RESULTS” instructions that come with many MCP tools are invisible in the Claude UI. They get silently injected into the model’s context at runtime. You won’t see them in settings, connectors, or anywhere obvious.

Example from ZoomInfo’s official Account Research tool (no malicious intent, but it does have unintentional consequences):

It explicitly encourages Claude to frame queries with rich user context, such as:
“Construct queries that frame the user's goal and describe what ideal context would look like. The more the query conveys about the situation and desired outcome, the better the response.”

If you have a long thread of context with proprietary information, Claude might choose to inject some of that proprietary information when prompting ZoomInfo.

e.g., if you’re casually discussing a company with Claude and it decides to query ZoomInfo with your strategic intent (M&A, diligence, competitive positioning, etc.), you've just leaked that info straight into an external tool. Claude won't ask for Account Research generically, it'll ask ZoomInfo for Account Research for the purposes of an acquisition thesis.

This is easy to miss because the only ways to discover it are:
- Asking Claude directly: “What instructions does the ZoomInfo MCP give you?”
- Or reading the MCP server prompts directly, but even then, they can change at any point unless you're hosting it yourself.

---

Defenses and a few options right now outside of strict policy on what Connectors your teams can/cannot use (note: these are not hardened safeguards, but they're better than nothing):

1. Persistent prompt guardrails – Add clear rules to Claude Settings or your project’s CLAUDE.md file (Claude reads this automatically every session, acting as persistent memory):

“When using XXX MCP/connector/plugin: NEVER include WHY you’re researching. No mentions of thesis, deal, diligence, evaluation, risks, or strategic context. Query ONLY factual data without any situational framing. Example: ‘Provide company overview, competitors, financials, and leadership for [Company]’.”

2. Hard enforcement with Claude Code hooks – Use shell scripts that run before every tool call. Scan the input for sensitive keywords (“acquisition”, “diligence”, “risks”, “thesis”, etc.) and block the call before it ever reaches ZoomInfo (or whatever MCP you've using).

3. Contract & policy due diligence – Review the MCP provider’s contract/SLA carefully. Look for explicit security guarantees, data handling policies, retention periods, logging, and clarity on whether user query context (especially strategic intent) is considered sensitive data and how it’s protected or stored.

---

Bottom line: MCP servers can quietly turn casual conversations into unintended data leaks. Combine awareness + persistent memory rules + hard hooks + contract review as basic hygiene until platforms add better visibility and controls.

The industry certainly needs better approaches to this than what's available today, and I'm certain they'll evolve, but this is one example of where a well-intentioned prompt or MCP usage could end up as an accidental leak.

[Tyler Moore @tylermoore]

Small quality of life enhancement that's well worth it if you work off a laptop and are on the road (not an ad, just a fan): a laptop sleeve that doubles as a stand.

Laptop webcam is better positioned and it allows for more comfortable posture.

https://t.co/VMWj3sTnfw

[Tyler Moore @tylermoore]

@Austen Pretty great value for top notch talent

[Tyler Moore @tylermoore]

I wish I knew in my early-mid 20s how important baseline labs were for your future. So much lab work analysis is relative vs absolute (e.g., numerical trends, not just a single score against permissible range). If you're in your early-mid 20s, highly recommend getting fully comprehensive labs at least once a year to have a baseline for the future.

[Tyler Moore @tylermoore]

I’d venture to guess the 75th percentile and higher of Claude users would pay 1-2k per month without batting an eye. 90th percentile and higher, likely 5-10k/month

I also suspect at some point people will need to start better reconciling what they use bleeding edge models for vs what they can use cheaper models for, but won’t until price increases