skills.rest
toderian
toderianCOMMUNITY
Explore all skills by this author →
GitHub

connectors-and-mcp

Enforces least-privilege rules for connector and MCP server access by autonomy level.

Updated Apr 6, 2026
Search Tags:#security#github#mcp#secrets#autonomy#connectors#least-privilege
One-click install
npx skills add https://github.com/toderian/project_template --skill connectors-and-mcp-toderian
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: connectors-and-mcp
Source: https://github.com/toderian/project_template/tree/main/plugins/agents-core/skills/connectors-and-mcp
Command: npx skills add https://github.com/toderian/project_template --skill connectors-and-mcp-toderian

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Agents using connectors and MCP servers can overreach: reading private data they should not, writing to live external systems without authorization, or leaking secrets into logs and commits. This Skill defines least-privilege rules so every connector action stays scoped, logged, and safe. ## Core Features & Use Cases - Autonomy-Based Permission Matrix: Maps connector read/write permissions to autonomy levels L0-L3, so an agent knows exactly which external actions are allowed at each level. - Secrets Handling Rules: Mandates that credentials stay in uncommitted .creds/ files, never appear in logs or PR bodies, and get redacted immediately if a connector response exposes them. - MCP Server Selection Guidance: Directs the agent to identify data owner, read vs. write mode, target object, and logging destination before acting, and to always pick the narrowest available connector. - Use Case: Before an agent comments on a GitHub PR or edits a Google Drive document, it checks the autonomy matrix, confirms the write is named in the task, and records a sanitized log entry. ## Quick Start Before using any connector or MCP server to read or write a live external system, apply the connectors-and-mcp rules to confirm the action is within the current autonomy level and log it.

Frequently Asked Questions about connectors-and-mcp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I control what an AI agent can do with MCP servers?▼

Use an autonomy-level matrix that separates connector reads from writes. At L0 only reads are allowed, L1 permits local repo writes, L2 allows narrow branch and CI writes, and L3 permits draft PR operations, with broad external writes never granted by default.

How should AI agents handle secrets from connectors?▼

Keep credentials in an uncommitted .creds/ directory, read them only when the task requires it, and list filenames without printing contents. If a connector response exposes tokens or keys, redact them immediately and never write them to logs, docs, or PR bodies.

When should an agent stop and ask before using a connector?▼

Stop before enabling new connectors, expanding scopes, writing to targets not named in the task, changing production or billing state, posting broad notifications, or continuing after unexpected sensitive data exposure.

How do I choose between multiple MCP servers for the same task?▼

Identify the data owner, read versus write mode, target object, and required autonomy level first. Then pick the narrowest connector, such as a GitHub PR connector for PR metadata instead of a broad browser session.

Can an agent write to Slack or shared docs autonomously?▼

No. Broad connector writes like posting to team chat, editing shared documents, or modifying issues outside the named task are not granted at any autonomy level and always require explicit user approval.

Related Skills

Explore More Software Engineering Skills→
managedcodemanagedcode
4

mcaf-source-control

Define repository source-control policies for branching, merging, and commit hygiene.

Official
Intermediate
mind-protocolmind-protocol
8

Update Module Sync State And Record Markers

Record module synchronization states and markers after each task execution.

Official
Intermediate
lzlatkinlzlatkin

knowledge

Initialize and update a structured markdown knowledge base with topic files and an index.

Community
Intermediate
sannabotdevsannabotdev
22

lists

Add, remove, check, and read items in local shopping, to-do, and packing lists.

Community
Basic