mcp

Before an agent gets write access to a real system, design the access pattern. The Model Context Protocol is the biggest attack surface in an AI-first stack; this command produces the config and policy that operationalise the three non-negotiables.

When to use it

• Before connecting an agent to a production database, deploy pipeline, payments system.
• Before exposing destructive operations (DELETE, refunds, sends).
• When security asks "what does the agent have access to?" and you cannot answer.
• audit flagged an ungated MCP config.

What it produces

• .context/mcp-config.json: starter configuration, scoped into four tiers.
• docs/mcp-policy.md: human-readable policy. Tiers, HITL rules, audit destinations.
• Optional per-server mcp-server-<name>.config.json stubs.

How it works

1. Inventory the systems. Read or write? Service account or user impersonation? "Hook it up to everything" is refused.
2. Sort into four tiers. Tier 1 read-only context. Tier 2 internal write. Tier 3 production read. Tier 4 production write. Placement shown before generation.
3. Name the tools. Verb plus qualifier (read_payment_by_id, refund_payment_to_customer). Blast radius visible in the name.
4. HITL in the config, not the prompt. Every Tier 4 tool gets requiresConfirmation: true. The policy names the modal, the approvers, the audit trail.
5. Auditing. Every server has a named log destination. Alerting on off-hours invocations, sensitive parameters, failure spikes, new tool combinations.
6. Credentials. One per tier, smallest possible role, stored in a named secret manager. Config references env var names, never literal secrets.
7. Cross-link. AGENTS.md gets a pointer to the policy so the agent finds it when it asks "can I do X?"