Platform / DevEx
Coding agents with production access
An autonomous coding agent opens PRs, runs CI, and can deploy or run migrations. The risk isn’t the code it writes — it’s the deploy hooks, CI secrets, and cloud credentials the pipeline can reach.
Real example — shipping today
source →GitHub · Copilot coding agent
Assign it a GitHub issue and it edits code in an ephemeral Actions runner, runs tests, and opens a pull request — reaching deploy hooks, CI secrets, and cloud credentials along the way.
Their own controls — GitHub confines it to a copilot/ branch, requires a human to review and merge, and gates CI behind an explicit approval.
The danger without a gate
A poisoned dependency or an injected issue body steers the agent into a destructive call — a force-push to main, a prod deploy — and one leaked token is enough to act as the agent with no record of what authorized it.
How MCPIP handles it, step by step
Read it top to bottom. Each step shows the real command and exactly what MCPIP returns — the same allow / step-up / denied envelope every time.
The agent asks to deploy to production
It calls the deploy tool through MCPIP with the full payload — the environment and the exact release.
$ mcpip --json authorize skill_deploy_service --arg env=prod --arg ref=v3.0.2{
"error": "step_up_pending",
"challenge_id": "chg_b81f42",
"correlation_id": "7c31c9e2"
}MCPIP holds it for a human
Because a prod deploy is high-risk, MCPIP doesn’t run it. It stages a one-time PIN bound to exactly this environment and release, and returns a challenge — nothing has executed.
A human approves — out of band
An engineer confirms with the one-time PIN. MCPIP verifies it, seals the decision to the signed WORM log, and only then does the deploy run.
$ mcpip --json complete --challenge chg_b81f42{
"decision": "allow",
"status": "executed",
"transaction_ref": "txn_01j9k2m4",
"executed_target_class": "rest",
"worm_sequence": 48213,
"correlation_id": "7c31c9e2"
}attackThe attack: a force-push smuggled into the arguments
Later, an injected instruction tries to force-push to main. It never staged an approval and isn’t in the agent’s grant — so it’s denied, opaquely. The agent only ever sees a correlation id.
$ mcpip --json authorize skill_git_push --arg branch=main --arg force=true{
"error": "denied",
"correlation_id": "b44a91d0"
}The result
Production reach without the ability to silently do irreversible damage.
The same flow, at a glance
Every command above runs against a local sandbox in one line.
run it yourself — curl … | bash && mcpip up →