Connecting a coding agent safely: keys, roles, and scopes over MCP

Giving an AI agent write access to your product workspace should worry you — it worried us, and we built the rules we wanted before wiring our own agent in. The connection itself is one command: claude mcp add ultipad --transport http, pointing at the workspace's MCP endpoint with a bearer key. Cursor, Codex, and Claude Desktop follow the same pattern.

Keys are people, not gods

Every API key belongs to a user and inherits that user's role and product scope. A reviewer key is read-only at the server: the write tools refuse it outright, so you can hand one to an analytics agent or an auditor with zero risk of it filing ideas. An editor key scoped to two products can read and write those two products — and receives not-found for everything else, never confirming other data exists. Scoping isn't a client-side filter; it's applied inside every tool handler.

What the 35 tools cover

Reading: product overviews, roadmaps, objectives, ideas, feedback, specs, workflow stages, reports summaries. Writing: creating ideas and feedback, drafting and fetching agent specs, adding user stories, linking work to initiatives and key results, recording commits with diff stats, posting comments (badged as AI), attaching files, and reporting dev progress — the call that moves workflow stages and checks off stories.

Two deterministic helpers keep agents honest in practice: a rules snippet for the agent's instructions file (check for an existing idea before building; report progress at start, blocked, and completion) and a post-commit hook that reminds the agent to record every commit with its git shortstat numbers. Reliability by construction, not by prompt-hoping.

Why this matters beyond us

Teams adopting coding agents hit the same wall: the agent is capable but context-blind, and every mitigation is a copy-paste ritual. A governed MCP surface fixes both — the agent reads the decision behind the ticket, and everything it does lands back in the system of record under its own identity.