# MCP Safe Usage Guide

How to use MCP without shooting yourself or the team in the foot.

## Per role

| Role                    | Profile               | Notes                                                                            |
| ----------------------- | --------------------- | -------------------------------------------------------------------------------- |
| Solo dev / feature work | `local-dev`           | Default. Confirms before mutations + compose lifecycle.                          |
| Reviewer / CI agent     | `ci-review`           | Read-only repo + CI. Asks before posting comments.                               |
| On-call / incident      | `production-readonly` | Sentry + read-only DB/Redis. No production mutations from MCP — use the runbook. |
| Designer                | `designer`            | Figma + Notion + read-only repo. No DB/CI.                                       |

## Hard "don'ts"

- Don't run a writable `postgres` server against a prod connection string.
- Don't enable `slack`/`linear` posting without `ask` — agent loops will spam channels.
- Don't put secrets inline in `.mcp/*` JSON. Use `${ENV_VAR}`.
- Don't load `local-dev` in CI.
- Don't share `.mcp/.memory` across machines — it can contain transcripts.

## When something feels off

- If a server is asking for write access you didn't grant, deny + check `.mcp/` for drift.
- If a server's stdio process won't die, kill it from the host's MCP manager (it's just an `npx` child process).
- If you're about to enable a new server, copy a small example to `.mcp/servers/<name>.json` and add it to one profile only — don't enable globally.

## Adding a new server

1. Add `.mcp/servers/<name>.json` with `transport`, `command`, `args`, `env` (env vars only — no values).
2. Add it to the relevant profile(s) under `.mcp/profiles/`.
3. Add a row to `permissions.md` explaining value + risk + default permission.
4. If it touches production, add it ONLY to `production-readonly` with `default: read-only`.
