Every MCP server you connect is a permission decision you made once and then forgot. This lesson is about making that decision deliberately.
The three questions
For each server, answer: **what can it read**, **what can it change**, and **who finds out if it changes something wrong**. If you cannot answer the third, you are not ready to enable writes.
A read-only token is not a formality. It is the difference between an agent that can explain a problem and one that can cause one.
The default that works
Start read-only. Add write scope for one capability at a time, with a human in the loop, and only after you have watched the read path produce correct results for a week.
| Capability | Default | When to upgrade | |---|---|---| | Read a database | Allow with a read replica or read-only role | never | | Read files in a project | Allow, scoped to one directory | when the directory boundary is wrong, fix the boundary | | Create a draft | Allow | after you have reviewed 20 drafts | | Send, publish, deploy | Human approval | never fully automatic | | Delete, rotate keys, move money | Not an agent task | — |Approval points
An approval prompt that fires on every action gets approved without reading by the third day. Put approvals where the cost of being wrong is irreversible: sending, publishing, deploying, deleting. Everything reversible should run without asking, or the human becomes the bottleneck and stops paying attention.
Audit
Log three things per action: what was called, with which arguments, and what came back. Not for compliance theatre — for the day someone asks why a record changed.
If your client does not keep this, wrap the server: a thin proxy that logs and forwards. It is twenty lines and it is the difference between an incident you can explain and one you cannot.
Kill switches
Have one. Being able to disconnect a server in ten seconds matters more than a perfect permission model, because the permission model will be wrong somewhere you did not anticipate.
Related
The comparison pages rate servers partly on blast radius — how much an agent can touch when it guesses wrong. That is the property to look for before you install, not after.
Next: back to the curriculum — or start with the MCP security model.