MCP

Before Claude Code becomes a team habit, security should ask about authority, boundaries, evidence, rollback, and ownership. These questions turn agentic coding from a demo into a reviewable operating model.

Claude Code permissions are safest when they are temporary. Treat every extra file, command, MCP tool, and network path as a task-scoped grant that must expire unless a human renews it with evidence.

Claude Code can produce a clean patch from a messy run. Production teams need a flight recorder: the task contract, tool calls, permission pressure, tests, assumptions, and rollback notes that explain how the patch was made.

Claude Code permissions are where agent safety becomes concrete. If a run needs production data, billing config, deploy access, or a wider MCP tool, the default should be stop, explain, and wait for a human decision.

MCP tools make Claude Code far more useful, but broad access turns a weak prompt into a production risk. Treat every tool as blast radius, not convenience.

I published Securing Enterprise AI Agents, a practical book on bounded AI autonomy, AgentSecOps, MCP security, RAG governance, identity, evals, policy, and evidence.

A ticket-summary task needs read access. Test whether tool exposure and credential scope actually prevent writes, with an executable fixture and a review record.

MCP makes Claude Code more useful, but every server also widens the blast radius. Treat MCP tools as production access paths with allowlists, approval gates, call logs, and rollback notes.

Claude Code: Building Production Agents That Actually Scale is now live on Amazon Kindle. Here is who it is for and why I wrote it.