| name | hr-product-mcp-governance |
| description | Product-runtime HR copilot MCP: catalog, transport, tenant isolation, HITL, hybrid protect-mcp shadow→enforce. Use for lib/copilot, MCP tool additions, red-team scenarios. Not Cursor IDE MCP plugins. |
| risk | critical |
| minRiskTier | T3 |
| source | project |
| disable-model-invocation | true |
HR product MCP governance
Collaboration plane: Specialized skill — phase 6 only after human tradeoffs recorded. Distinct from Harness HITL (@hr-human-collaboration).
Use this skill when
- Editing
lib/copilot/ (catalog, transport, governance config)
- Adding or changing tools in
COPILOT_TOOL_CATALOG
- Wiring MCP stdio/websocket transport (Phase 3)
- Red-team or audit scenarios for cross-tenant tool calls
Do not use this skill when
- Configuring Cursor workspace MCP plugins (Prisma, Figma, etc.) — use
@protect-mcp-governance on the IDE plane
- MLOps inference routing only (
docs/ml/, services/ml-serving/) — use @hr-regulated-domain mlops L3
- T1/T2 work with no copilot or threat-model surface
Instructions
- Read hr-copilot-mcp.md and agent-mcp-threat-model.md.
- Catalog: Zod
inputSchema.parse before handlers; RBAC permission from descriptor; no direct Prisma in handlers — reuse lib/* with AuthContext.
- Identity:
tenant_id / subject_id only from JWT/session — never from model arguments.
- Side effects: High-stakes mutations via
lib/governance/ proposals + HITL — not raw tool execution.
- Hybrid boundary: Cedar + shadow mode per transport-rollout.md; enforce only after shadow validation.
- Tests: Extend
tests/unit/copilot/mcp-tools.test.ts — unique names, read permissions, validation, unknown tool denial.
- Update threat-model review checklist when adding tools.
Resources
Limitations
- Engineering controls only — not legal advice
- Transport may remain scaffold until Phase 3 exit criteria in
implementation-sequence.md
