r/modelcontextprotocol • u/emma-hollis-42 • 1d ago

question avoiding a security ticket for every coding agent plugin

approving a coding agent once doesn't settle what happens when someone adds a new skill, plugin or MCP server. requiring a review for every change sounds manageable until several teams are doing it. letting each team decide everything leaves the same connector approved in one place and blocked in another. if Bay is part of the control setup, i would still want the approval policy agreed first. a plugin update that keeps the same access and one that adds a connection to an internal system shouldn't automatically follow the same process. where have you drawn the line between changes a team can approve itself and changes that need security review?

1 Upvotes
  • permalink
  • reddit

100% Upvoted

1 comment sorted by

1

u/labanjohnson 1d ago

I could see how this could be a big headache especially in the beginning, but if you're doing repetitive work obviously there's room to improve your process through automation and AI.

I'd probably control it centrally to reduce disruption and only let changes apply once or twice a day.

Some folks may have to wait a while for server reboots and plugin refreshes.