# OSVx MCP Tool Policy

This document defines the security classification and exposure tiers for all MCP tools.

## Tier 1: Safe Reads
- **Description:** Public, cacheable, low-risk data.
- **Tools:** `list_emma_models`

## Tier 2: Scoped Reads
- **Description:** Requires authentication; reads sensitive but non-modifying data.
- **Tools:** `get_billing_history`, `get_file`, `get_emails`

## Tier 3: Compute Tools
- **Description:** Requires authentication; triggers non-state-changing computations.
- **Tools:** `run_jason`, `run_emma`

## Tier 4: Confirmed Actions
- **Description:** State-changing actions that should require user confirmation (HITL).
- **Tools:** `create_issue`, `set_billing_budget`

## Tier 5: Restricted Admin
- **Description:** High-risk administrative tools that must be protected by strict, server-side authorization.
- **Tools:** `run_terminal`, `trigger_build`, `delete_email_alias`