# MCP Security Policy

## Hard rules

1. **Never store real secrets in `.mcp/` files.** Use `${ENV_VAR}` references — values come from the OS/shell or the secret manager at run-time.
2. **Production credentials are read-only by default.** Mutations require explicit human approval.
3. **Destructive operations require confirmation.** Any `mutation`, `ddl`, `delete`, `flushall`, file write outside the workspace, or message post.
4. **CI defaults to `production-readonly`.** Never load `local-dev` in a pipeline.
5. **`local-dev` is opt-in**, not auto-loaded. A developer chooses when to use it.
6. **Every server runs over `stdio` from `npx`.** No long-running daemons exposed to the network.
7. **Every server has an audit trail** via the host's MCP log.

## Forbidden combinations

- `production-readonly` profile + any server with write permissions enabled.
- `slack`/`linear`/`github` post permissions enabled without `ask`.
- `filesystem` with write access outside `${workspaceFolder}`.

## What to do if a secret leaks into an MCP config

1. Rotate the credential immediately.
2. `git log -p .mcp/` to confirm what was committed and when.
3. Add a `.mcp/` test case to the secret-scan hook (`.claude/hooks/secret-scan.sh`).
4. Open an incident note via the `incident-orchestrator`.
