Skill Hub — AI-Assisted Development

MCP development workflow

Use MCP and tool servers safely for development workflows: read-only vs write-capable tools, permission boundaries, local filesystem risks, GitHub write risks, and audit logging.

What this skill is for

This skill helps you connect MCP servers to coding agents without over-privileging them. The output is an MCP server inventory with classification, scopes, approval rules, and audit steps.

When to use this skill

  • You want an agent to read documentation, search code, or query observability data through MCP.
  • You are considering an MCP server that can write to GitHub, the filesystem, or a deployment pipeline.
  • You need to audit which tools your agents can invoke.
  • You are building or deploying an MCP server for your team.

Real work situations

Connect a documentation MCP server

You add an MCP server that fetches internal docs. You classify it as read-only, restrict it to HTTPS, and verify it cannot write. The agent can now answer questions without gaining filesystem access.

Connect a GitHub MCP server

You add a GitHub MCP server so an agent can read issues. You use a fine-grained token with read-only issue access, not a token that can write code or merge PRs. Write access is reserved for explicit human approval.

Build a custom MCP server

You build an MCP server that wraps an internal API. You declare exactly which tools it exposes, use capability attestation where possible, and log every invocation for audit.

Inputs required

  • MCP server list — every server the agent can reach.
  • Tool inventory — tools, resources, and prompts each server exposes.
  • Classification — read-only or write-capable for each tool.
  • Scope definitions — directories, repositories, domains, or API endpoints the tool may access.
  • Host configuration — approval settings, logging, and transport details.

Questions to ask

  • What can each MCP server read and write?
  • Does the server need broad access, or can it be scoped to one repo or directory?
  • Who wrote the server, and can it be compromised or poisoned?
  • Are tool calls logged for audit?
  • What happens if a tool returns malicious instructions?

Working method

  1. Inventory servers. List every MCP server configured in the agent host.
  2. Map tools and resources. Document what each server exposes.
  3. Classify risk. Mark each tool as read-only or write-capable.
  4. Assign scopes. Restrict filesystem, GitHub, browser, and API access to the minimum needed.
  5. Configure approval gates. Require explicit approval for every write or destructive action.
  6. Enable logging. Record tool calls, arguments, and outcomes.
  7. Review periodically. Check that permissions still match actual usage.

Decision rules

  • If a server can write, it needs explicit approval for each write.
  • If a server is from an untrusted source, do not install it.
  • If a server requests broad filesystem access, deny or restrict it to a specific directory.
  • If a server fetches web content, limit it to allow-listed domains.
  • If a tool call can affect production, require a second human review.

Deliverables

  • MCP inventory — server, tools, classification, scope, and owner.
  • Approval policy — which actions require human approval.
  • Audit log configuration — how tool calls are recorded.
  • Incident response note — what to do if a server is compromised.

Templates

MCP inventory entry

Server: [name]
Source: [official/community/internal]
Transport: [stdio/sse/http]
Tools:
- [tool name]: [read-only/write-capable]
- [tool name]: [read-only/write-capable]
Scope: [directories/repos/domains allowed]
Approval policy: [auto / prompt / block]
Owner: [team or individual]
Last reviewed: [date]

Approval policy

Auto-allowed:
- Read-only documentation retrieval
- Read-only code search within allowed directories

Prompt-required:
- Any filesystem write
- Any GitHub issue/PR/comment creation
- Any deployment or CI trigger

Blocked:
- Repository deletion
- Secret or credential access
- Production data writes

Quality checklist

  • Every MCP server is inventoried and classified.
  • Write-capable tools require explicit approval.
  • Scopes are restricted to the minimum necessary.
  • Tool calls are logged and reviewable.
  • Untrusted servers are not installed.
  • The team knows the incident response path.

Common mistakes

  • Installing servers without inventory. Consequence: unknown tools can be invoked.
  • Granting write access by default. Consequence: agents make unreviewed changes.
  • Ignoring prompt injection. Consequence: fetched content manipulates the agent.
  • Disabling logging. Consequence: no audit trail when something goes wrong.

Agent instructions

When using this skill, start by listing every MCP server available to the agent. Document each tool, its classification, and its scope before using it. Never assume a server is read-only; verify. Apply least privilege. If a tool request exceeds its declared scope, reject it and report. Keep logs of all tool invocations.

Related skills

Related Atlas pages

Verification status and limitations

This skill is a public working interpretation of MCP security practice. The MCP specification and authorization model are evolving; verify current guidance on modelcontextprotocol.io and follow current security advisories.