Capstone — the guarded agent checklist

At a glance

Learning objectives

• Run the series checklist against a complete agent setup
• Prove each guard with an attempted violation, not a promise
• Know which artifacts to keep — config, classification table, approval log

What you need

• The agent setup from lessons 2 through 9
• A non-production database and repository
• The DE Data Toolkit plugin and the contract-auditor skill installed

Steps

1. Skills in place — SKILL.md with front-matter (name, description, version), plus references/, scripts/, and examples/ directories that the agent loads on demand. (from ref-agent-skills )
2. Tools scoped at the connection — the filesystem server grants read/write within the directories you pass as arguments, so scope it to a single working directory and never pass a home directory or a mount containing secrets. (from mcp-filesystem )
3. Credentials least-privilege — a fine-grained GitHub token limited to the target repositories, read-only unless the task must open PRs; never org-wide admin. (from mcp-github )
4. Contracts audited — tools that can write, delete, spend money or exfiltrate data flagged, and a least-privilege connection recommendation produced. (from skill-mcp-tool-contract-auditor )
5. Hooks active — destructive statements are denied by default, and a DELETE/UPDATE without a WHERE clause is always denied. (from hook-destructive-sql-guard )
6. Secrets gated — staged diffs scanned for high-confidence secret patterns; pattern matches block the commit. (from hook-secret-scan-commit )
7. The pattern underneath — separate read/recommend from write/execute, execute scoped and logged, and keep a human in the loop for anything irreversible. (from pattern-agent-in-the-loop-review )

Check yourself

• A write against a production target is suspended pending an approve-once token scoped to the single call.
• A staged connection string with a password is blocked at commit; a DROP TABLE is denied before any database call.
• The agent's permissions read like the review agent's — filesystem read-write, network none, credentials none.

Worked example

A SKILL.md file with front-matter (name, description, version), plus
references/, scripts/, and examples/ directories that an agent loads
on demand.

read ─▶ recommend ─▶ human approves ─▶ execute (scoped, logged)

Destructive statements are denied by default; a DELETE/UPDATE without a
WHERE clause is always denied. Failure behavior: block.

Sourced from

• Agent Skills (open format)
• Filesystem MCP Server
• GitHub MCP Server
• MCP Tool Contract Auditor
• Destructive SQL Guard
• Secret Scan on Commit
• Agent-in-the-Loop Review

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

• Prove each guard with an attempted violation — a promise in config is not a hook firing.
• Destructive statements are denied by default — if yours went through, the hook was not on the tool path.
• Blast radius can be production — re-check scope after every new tool or credential.

Production considerations

• Keep the tools-by-class table, the connection configs and the approve-once log together as the agent's audit pack.
• The starter plugin is the baseline — SQL/Spark review skills, the destructive-SQL guard, a secret scanner and the file/git MCP servers, wired together.

Diagram

guarded agent checklist
   |
   |- skills --> SKILL.md + references + examples, loaded on demand
   |
   |- tools --> one dir, one repo, one scoped token
   |
   |- contracts --> Read/Write/Destructive/Spend/Exfiltrate classified
   |
   |- hooks --> destructive denied, prod writes approve-once, secrets blocked
   |
   |- pattern --> read/recommend vs write/execute --> human gate

Registry stats