Security & Compliance
MCP Safety
Safety expectations for IncidentFlow MCP tools.
IncidentFlow MCP tools are registered with metadata describing whether they are read-only or can write operational knowledge.
Expectations
- Read-only tools should never mutate workspace state.
- Memory write tools should be idempotent where possible.
- Tool responses should avoid exposing credentials, tokens, or private URLs.
- Workspace-scoped tools require authenticated workspace context.