We use MCP when security and tight capability boundaries are important.

For example, even GitHub’s fine-grained tokens aren’t always fine-grained enough for our use cases. In those situations, it’s straightforward to build a small MCP server that exposes exactly the operations we want an agent to have access to.

That gives us a much smaller and more explicit attack surface, without having to manually audit every possible GitHub CLI invocation the agent might make.