| name | MCP Go-Live |
| description | Guide developers through Intility's production go-live checklist for MCP servers, ensuring security compliance with the lethal trifecta rules, Intility Software Engineering Policy, and infrastructure requirements. Use when a developer is ready to deploy an MCP server to production. |
MCP Go-Live Production Checklist
This skill guides developers through Intility's production go-live process for MCP servers, ensuring security, compliance, and operational readiness.
When to Use This Skill
Use this skill when a developer is ready to deploy an MCP server to production at Intility. This skill will guide them through a systematic validation and setup process.
How This Skill Works
This skill uses progressive disclosure - you will load only the minimal information needed at each phase rather than overwhelming the developer with all requirements upfront.
Skill Organization
Guide the developer through each phase systematically, loading the relevant file for each phase:
Phase 1: Security Assessment
File: security/lethal-trifecta-check.md
Validate that the MCP server complies with lethal trifecta security rules:
- Access to private data: OBO only ✓
- Untrusted content: NOT in LLM context ✗
- External communication: NONE ✗
CRITICAL: If the MCP server combines all three lethal trifecta elements, STOP immediately and require redesign before proceeding.
Phase 2: Policy Compliance
File: security/intility-policy-check.md
Verify compliance with Intility Software Engineering Policy covering:
- Source code repository and documentation
- Release management and code review
- Testing with test/mock data only
- Environment separation
- Security scanning
- Zone Model compliance
Phase 3: Infrastructure Setup
Files: infrastructure/envoy-gateway-setup.md, infrastructure/audit-logging-config.md
Guide the developer through:
- Envoy Gateway API installation with proper security contexts
- Audit logging configuration
Phase 4: Authentication Validation
File: authentication/obo-validation.md
Verify On-Behalf-Of (OBO) authentication implementation:
- No API keys or service principals
- Data access scoped to logged-in user
- Data filtering enforced based on identity
Phase 5: Observability Setup
File: observability/logfire-setup.md
Ensure OpenTelemetry instrumentation is configured:
- Traces sent to Intility's Logfire instance
- Proper span attributes
- Monitoring dashboard created
Phase 6: Final Verification
File: templates/go-live-report.md
Generate a production readiness report documenting:
- All completed checklist items
- Configuration used
- Approval and timestamp
Instructions for Claude
- Start by asking which phase the developer is in, or if they want to start from the beginning
- Load ONLY the relevant file for the current phase (use the Read tool)
- Guide the developer through validation and setup for that phase
- Mark completion before moving to the next phase
- Use checkboxes to track progress through each phase
- Generate the final report when all phases are complete
Important Constraints
- Never skip the security assessment phase
- Block progression if critical security requirements are not met
- All commands should be shown for developer to execute (don't auto-execute destructive operations)
- Ask validation questions from each file to confirm understanding
- Keep the developer informed of progress throughout
Example Interaction Start
Developer: I need to deploy my MCP server to production
You: I'll guide you through Intility's MCP go-live checklist to ensure your
server meets all security and compliance requirements.
We'll go through 6 phases:
1. Security Assessment (Lethal Trifecta)
2. Policy Compliance
3. Infrastructure Setup
4. Authentication Validation
5. Observability Setup
6. Final Verification
Have you already started any of these phases, or shall we begin with
Phase 1: Security Assessment?
Red Flags to Watch For
If you detect any of these, STOP and address immediately:
- ❌ All three lethal trifecta elements present
- ❌ Production data used in development/testing
- ❌ API keys or service principals instead of OBO
- ❌ Missing CI/CD pipeline
- ❌ No security scanning
- ❌ Prohibited MCP content types (audio, images, resource links)
