# Hand-offs: read-only routes and who builds after approval

This skill designs and reviews; it never applies changes. Use the routes below to read current settings without write access, and hand approved change requests to the people or vendor tools listed. Endpoints and scopes were read on 2026-11-01, and on 2026-11-06 for the routes that say so; confirm them on the vendor's page before connecting anything, and run a new connection through the mcp-security-review skill first.

## Rules for every route

- Prefer an export or a settings screenshot over a live connection.
- When a live connection is needed, use the narrowest read scope, and set every write tool to require approval in the AI client.
- Never call write, execute, replay, resend, resync, subscription or publish tools while designing or reviewing. The one exception is a test case the user approved ([test-plan.md](test-plan.md)).
- Never ask for, print or store API keys, tokens, passwords or signing secrets. n8n and Make exports can hold literal header or query values: ask for them replaced, run `check_ipaas_export.py` before opening the raw JSON, never quote a header or query value, and list rotation in the change list when IX05 fires.
- Any agent that later applies an approved change follows the agent-write-safety skill: inventory, read-only pass, change list, approval, smallest batch, read-back, change log, rollback.

## Per tool

HubSpot:

- Read: remote MCP at `mcp.hubspot.com` (OAuth 2.1 with PKCE, generally available since 13 April 2026; changelog, checked 2026-11-06). It reads and writes CRM records, within the user's permissions and the app's scopes. The AI tool can handle scopes for you, so a read-only set may not be selectable in a directory connector: use read scopes where you create the app yourself, run `get_user_details` to list the objects and tools the connection grants, and set every write tool to require approval in the client. Field history in the record UI and app webhook subscription settings need no connection. Usage headers `X-HubSpot-RateLimit-*` appear on any response the user captures.
- Docs: the developer docs MCP at `developers.hubspot.com/docs/mcp` searches documentation only.
- Build after approval: a HubSpot developer or admin applies properties, unique value properties and app settings from the change list.

Salesforce:

- Read: the hosted MCP SObject Reads server (no create, update or delete; production endpoint `api.salesforce.com/platform/mcp/v1/platform/sobject-reads`; off by default, an admin enables it under API Catalog, MCP Servers, and activation can take up to 2 minutes; checked 2026-11-06). Orgs that block logins from login.salesforce.com or test.salesforce.com use a My Domain URL instead (server URLs page). Object, field and sharing permissions apply. Field history, System Overview API usage, and the REST Limits resource run by the user (needs View Setup and Configuration).
- Note: Salesforce says any of its MCP servers will need agent registration within three months of its notice, so check article 005360285 before relying on a connection (read 2026-11-06).
- Note: the local DX MCP server reached end of life on 2 November 2026: no further releases or support, its repositories are archived, and the deprecated npm package stays installable (forcedotcom/mcp retirement notice, checked 2026-11-06). Use the hosted servers for reads.
- Build after approval: a Salesforce admin; forcedotcom/sf-skills for metadata work.

Stripe:

- Read: Stripe MCP at `mcp.stripe.com` with OAuth or an agent API key granting read permissions only; use `stripe_api_read`, never `stripe_api_write`. From December 2026 Stripe MCP rejects full-access secret keys and restricted keys without the Agent tag (migrate by 30 November 2026; checked 2026-11-06). Some writes need human confirmation in the Dashboard. Event destinations and event deliveries are visible in Workbench.
- Build after approval: stripe/ai skills (stripe-best-practices) for handler code.

Klaviyo:

- Read: remote MCP `mcp.klaviyo.com/mcp` with `read-only=true` and `disable-tools-with-user-generated-content=true` on a custom connector; the listed directory connectors cannot set these parameters. System webhooks list and Get Events for recovery checks.
- Build after approval: a Klaviyo admin from the change list.

Braze:

- Read: remote MCP `mcp.braze.com/mcp` (EU `mcp.braze.eu/mcp`) with OAuth. An admin grants the Use MCP Server permission per workspace, and the agent's access mirrors the signed-in dashboard user. It has read and write tools: campaigns (edit tools need the campaign APIs beta), catalogs, segments, email templates, content blocks, media library uploads and CDI sync triggers. Canvas tools are read-only and user-level personal data is excluded. The local server released in August 2025 is deprecated. Keep write tools on approval, or review from exports (overview, setup and tool list pages, checked 2026-11-06).
- Build after approval: a Braze admin; braze-implementation-qa for SDK and data checks.

Customer.io:

- Read: MCP `mcp.customer.io/mcp` (EU accounts connect through it too; `mcp-eu.customer.io/mcp` is the fallback) with only the `read` scope, which is the default. `read:sensitive`, `write`, `write:live` and `configure` are separate scopes the client asks for at connection, so deny them (checked 2026-11-06).
- Build after approval: Customer.io's official agent plugin and its customerio-pipelines skill.

Pipedrive:

- Read: the MCP at `mcp.pipedrive.ai/mcp` acts with the connected user's permissions. Its tools add and update records, and the support pages describe no read-only mode (MCP tools article, checked 2026-11-06), so prefer API reads of webhooks, Recents and deal history run by the user.
- Build after approval: a Pipedrive admin.

Segment:

- Read: workspace settings in the app, or the Public API with a read token the user holds. The Twilio docs MCP at `mcp.twilio.com/docs` serves documentation only; there is no first-party control-plane MCP.
- Build after approval: the workspace owner through the app or Public API.

RudderStack:

- Read: RudderStack MCP reads tracking plans, violations and the catalog, but its page documents no read-only mode, so keep it out of reviews unless the client exposes only read tools (checked 2026-11-06). Its write tools switch the active workspace, create or update transformations and audiences and connect transformations to destinations; with audience activation they also create destination and Reverse ETL sync resources, trigger sync runs and update audience membership. Its sensitive execution tools run code, and a transformation test can make outbound requests.
- Build after approval: rudderlabs/rudder-agent-skills (rudder-destination-debugging).

Hightouch:

- Read: sync settings, run history and rejected rows in the app. The docs MCP at `hightouch.com/docs/api/mcp` needs no authentication. The Hightouch product MCP builds audiences and journeys, so keep it out of review runs unless a read-only configuration is verified.
- Build after approval: a Hightouch workspace admin from the change list.

Fivetran Activations:

- Read: sync settings, run history and rejected records in the app; fivetran/fivetran-mcp with `FIVETRAN_SCOPE=read` (the default) and the repository's recommended `DISALLOWED_ACTIONS` denylist for credential endpoints. The server marks writes with advisory warnings but does not enforce confirmation.
- Build after approval: a Fivetran admin; fivetran/skills for analysis.

Zapier:

- Read: the Zap editor and Zap history; `check_ipaas_export.py` does not read Zap exports, so review each step by hand. Zapier MCP executes connected-app actions (two tasks per successful call, failed calls free), so it does not belong in a review.
- Build after approval: zapier/agent-skills (create, modify, doctor workflows).

Make:

- Read: Export Blueprint, or Make MCP (`mcp.make.com/v2` with OAuth) connected with read scopes only. Management tools need a paid plan and their scopes; scenario run tools execute scenarios.
- Build after approval: integromat/make-skills (make-scenario-building, make-scenario-operations).

n8n:

- Read: download the workflow JSON (preferred), or use the instance-level MCP: `search_workflows` to find it and `get_workflow_details` at the default full detail level to read it. MCP output is sanitized: credential references are stripped and the reference page does not say node parameters survive, so `check_ipaas_export.py` lists any node without parameters under Not checked (tools reference, checked 2026-11-06). `execute_workflow` runs the published production version by default, and MCP access is not scoped per client.
- Build after approval: n8n-io/skills (n8n-error-handling-official, n8n-workflow-lifecycle-official).

Google Ads:

- Read: googleads/google-ads-mcp with `labels: false` and `assets: false` in `tools_config.yaml`, which leaves `list_accessible_customers`, `search` and `get_resource_metadata`. The repository README enables write tools by default (`create_asset`, `upload_video_asset`, `manage_labels`, `manage_label_associations`), though Google's developer page still calls the server read-only, so check the tools the client lists (both read 2026-11-06). Conversion uploads, and most new Customer Match integrations since 1 April 2026, go through the Data Manager API, run by the approved pipeline.
- Build after approval: the warehouse-conversion-upload-kit skill (planned); until it ships, the approved pipeline's owner.

GA4:

- Read: googleanalytics/google-analytics-mcp with the `analytics.readonly` scope and `--allow-write` left off (the default), run locally or over HTTP with OAuth. Write tools need that flag and the `analytics.edit` scope (1.0.0 of 3 November 2026, checked 2026-11-06). Measurement Protocol payloads are checked against the validation server, whose events never reach reports.
- Build after approval: tracking-plan-builder for event contracts.

## Docs indexes for live checks

- HubSpot: `developers.hubspot.com/docs/llms.txt` and the docs MCP.
- Stripe: `docs.stripe.com/llms.txt`.
- Twilio Segment: `twilio.com/docs/llms.txt` and the docs MCP.
- Hightouch: `hightouch.com/docs/llms.txt` and the docs MCP.
- Make: `help.make.com/llms.txt`. n8n: `docs.n8n.io/llms.txt`. Zapier: `docs.zapier.com/llms.txt`.
- Customer.io, Braze, Fivetran, Pipedrive, Salesforce and Adobe Experience League: the llms.txt entries in `sources.yaml`.