# MCP Permissions — Server Catalog

What each server is for, the risk it carries, and which profile owns it.

| Server                | Value                      | Risk                                                   | Default permission                                  | Profiles                                                          |
| --------------------- | -------------------------- | ------------------------------------------------------ | --------------------------------------------------- | ----------------------------------------------------------------- |
| `filesystem`          | Read/write repo files      | Write outside workspace would be catastrophic — denied | Write allowed inside workspace only                 | local-dev, ci-review (read), designer (read)                      |
| `github`              | Issues, PRs, code search   | A PAT with `repo` scope can rewrite history            | Read-only token recommended; posting requires `ask` | local-dev, ci-review                                              |
| `gitlab`              | MRs, issues, pipelines     | Same as github                                         | Read-only token recommended                         | ci-review                                                         |
| `postgres`            | Schema + ad-hoc queries    | Data exfil + accidental writes                         | Read-only by default; `ask` for mutations           | local-dev, production-readonly                                    |
| `sqlserver`           | Same as postgres           | Same                                                   | Read-only by default                                | local-dev (when SQL Server is the secondary), production-readonly |
| `redis`               | Queue + cache inspection   | `FLUSHALL` wipes everything                            | Read-only by default; deny `flushall`               | local-dev, production-readonly                                    |
| `docker`              | Container introspection    | Compose lifecycle ops can disrupt local services       | Read-only; `ask` for `compose:up/down/restart`      | local-dev                                                         |
| `playwright`          | Browser automation         | Can hit external sites; can capture screenshots        | Default OK                                          | local-dev                                                         |
| `memory`              | Persistent knowledge graph | Knowledge graph holds context — could leak if synced   | Local-only (`.mcp/.memory`, gitignored)             | local-dev                                                         |
| `sequential-thinking` | Multi-step reasoning       | Low                                                    | Default OK                                          | local-dev, ci-review                                              |
| `sentry`              | Errors + issues            | Tokens can read all project data                       | Read-only token                                     | production-readonly                                               |
| `linear`              | Issues + cycles            | Token can edit issues                                  | Default; posting requires `ask` if added            | local-dev                                                         |
| `slack`               | Team comms                 | Posting affects humans                                 | Posting requires `ask`                              | local-dev                                                         |
| `figma`               | Design files               | Token can read files in connected teams                | Read-only API key                                   | designer                                                          |
| `notion`              | KB + notes                 | Token can read shared pages                            | Default                                             | designer                                                          |
| `time`                | TZ-aware time              | None                                                   | Default                                             | every profile                                                     |
| `brave-search`        | Web search                 | Sends query to a 3rd party — don't include PII         | Default                                             | local-dev, ci-review                                              |

Replace any of the above with project-specific picks (e.g. `tavily` instead of `brave-search`, `confluence` instead of `notion`) without changing the policy shape.
