The MCP surface

Every discipline in the AI-engineering transition converges here. Your agents commit code. They pull dependencies. They need credentials. They push. Every one of those is a trust boundary crossing performed by something that is not a person, at a volume no person could match, with an audit trail that does not currently exist.

An agent with a raw shell has your permissions and your tokens. An agent with a brokered tool surface has scoped capabilities and a receipt. The difference is not a policy. It is an architecture.

Agents get a structured tool surface covering the same operations humans use — 54 tools delivered as securegit-mcp. Work-dir scoping is not optional theater. Point the server at a real git repository with --work-dir or SECUREGIT_MCP_WORK_DIR. Non-repository paths are rejected.

• Handles, not values. Agent-facing tools accept secret handles. They do not accept, return, or display credential values.
• Guarded destructive operations. Operations that destroy or overwrite require explicit confirmation. Some stay unavailable to agents by policy.
• Everything is scanned and anchored. An agent commit passes the same gates a human commit does.
• Provenance survives. Blame with chain overlay means “which lines did an agent write” is a query, not an investigation.