diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e5ade69..f76a6e0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,6 +7,9 @@ on:
 
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/lib/chatwerk/cli.rb b/lib/chatwerk/cli.rb
index e1aaa1a..28e19ae 100644
--- a/lib/chatwerk/cli.rb
+++ b/lib/chatwerk/cli.rb
@@ -17,7 +17,7 @@ def mcp
     desc 'inspect [WORKING_DIRECTORY]', 'Run the MCP inspector with an optional working directory path (defaults to current directory)'
     def inspect(working_directory = nil)
       pwd = working_directory || Dir.pwd
-      system("npx @modelcontextprotocol/inspector -e PWD=#{pwd} bundle exec exe/chatwerk mcp")
+      system('npx', '@modelcontextprotocol/inspector', '-e', "PWD=#{pwd}", 'bundle', 'exec', 'exe/chatwerk', 'mcp')
     end
 
     desc 'print_env', 'Show current environment details'