Treat MCP access like production API access — least privilege, short-lived secrets, and supervised writes.
Least privilege
| Role | Docs MCP | Platform read | Platform write | AI MCP |
|---|---|---|---|---|
| Docs Q&A agent | ✓ | — | — | — |
| Integration engineer | ✓ | ✓ | staging only | optional |
| Operator copilot | ✓ | ✓ | supervised | ✓ |
Token handling
- Store in secret managers / host secret slots.
- Never embed in skills, repos, or shared chats.
- Prefer header auth over
?token=. - Rotate on personnel change and after suspected leak.
Write safety
- Default agent prompts to read-only.
- Require an explicit confirmation step for mutating tools.
- Log tool name, args (redacted), and actor for audits.
- Disable write scopes on tokens used in unsupervised loops.
Network & environments
- Use staging MCP bases for experiments.
- Separate production tokens from CI smoke tokens.
- Follow rate limits to avoid locked workspaces.