# Hand-offs: sibling skills and vendor tools in read-only mode Tool lists change. In each session, list the tools the live client actually exposes and compare them with this page before the first call. A client's confirmation prompt is not enforcement; the enforcing layer is the scope, key, role or vendor switch named below. ## Sibling skills by finding type Existing: - gtm-container-audit: unknown senders, duplicate Google tags, consent gates in the container, container ownership. - consent-debugging: tags before consent, two consent default owners, CMP behaviour by region. - purchase-reconciliation: unexplained purchase gap above 5%, purchase duplicate rate above 0.5%. Orders only. - tracking-break-map: a lead or sign-up gap above 5%, any ratio outside its 28-day band, numbers that moved after a release. - ga4-unassigned-not-set-diagnosis: Unassigned or (not set) growth. - tracking-plan-builder: no tracking plan, or events nobody can explain (retrofit). - event-naming-convention, utm-convention-and-registry, campaign-naming-convention: naming drift found during the screen. - braze-implementation-qa: Braze delivery, eligibility or identity findings. - hubspot-implementation-plan: when a HubSpot rescue or rebuild is the outcome. - agent-write-safety: any write through an MCP server or API after approval, and its per-connection inventory. - marketing-context-kit: no martech-context folder yet; record the register and decisions there. - analytics-tool-selector: replacing an analytics tool. - attribution-model-selector: attribution disputes that surface in the screen. - crm-audit: one CRM's configuration, property governance and field writers. Its FLD-02 rule and `writer_history.py` give the evidence for a two-writer finding inside a CRM. - crm-data-hygiene-audit: KEY findings; the duplicate, owner, stage and association repair queue. - ga4-audit: one GA4 property's configuration. - tracking-audit: the screen fails on more than one workflow, or a site needs a full tag, consent and conversion inventory. - tracking-plan-audit: a tracking plan exists but collection has drifted from it. - marketing-data-audit: warehouse models, tests, freshness and activation syncs, and numbers that disagree between the warehouse or a dashboard and finance, platforms or the CRM. Orders against analytics, one by one, stay with purchase-reconciliation; a number that broke on a known date stays with tracking-break-map. - lifecycle-marketing-audit: journeys, suppression, frequency caps and deliverability. Also whenever two or more tools send email from the company's domains: sender authentication (SPF lookup count, DKIM, DMARC alignment). - martech-integration-engineering: redesigning or repairing one flow after FLW01, FLW02, FLW04 or FLW05, with its field ownership register, retries, alerts and replays. - revops-workflow-design: lifecycle stage, lead status and handoff rules found broken on the lead to opportunity workflow, and who may set those fields. - marketing-mcp-setup: choosing and scoping an AI connection, read-only first. - mcp-security-review: a per-server review before anyone connects it. Two writers on one field (FLW01), in this order: - Evidence: the field's history. In a CRM, crm-audit's FLD-02 and `writer_history.py`; elsewhere each tool's logs. - Decision: the field's business owner names one authority. For lifecycle stage, lead status, deal stage or record owner, revops-workflow-design says who may set the field. - Repair: martech-integration-engineering writes the flow's field map (its field ownership register), conflict rule and change list. FLW01 only asks whether an authority rule exists; that skill's FO01 and FO02 then test the rule. - Record the decision in `decisions.md`. Planned (use the interim route until they ship): - crm-sync-and-field-ownership: a field contract for FLW01 two-writer findings. Interim: the route above. - google-ads-account-audit: account structure and conversion setup. - pipeline-connector-qa, reverse-etl-and-audiences, data-contracts-freshness-and-quality: pipeline, sync and freshness repairs. Interim: martech-integration-engineering for one flow, marketing-data-audit for the warehouse. - identity-resolution-and-customer-view: identity map design after KEY findings. - preferences-caps-and-suppression, journey-spec-and-qa: suppression and journey eligibility repairs. Interim: lifecycle-marketing-audit. - martech-stack-map, martech-raci-and-handover, martech-business-case, martech-cost-forecaster, stack-by-stage-and-industry: the diagram as a deliverable, the ownership pack, the business case, the bill forecast, buying guidance. - tracking-monitoring-and-incidents: turning acceptance tests into recurring checks. ## Vendor tools by area, read-only settings Spend and contracts: - Ramp MCP server: the hosted server at `mcp.ramp.com/mcp`. Choose Read-only on the consent screen (Full access is the default); read-only connections do not list tools that make changes, and Ramp MCP uses no OAuth scopes. It also follows the signed-in user's Ramp role, so connect a user who sees only what the audit needs. Enforcing layer: the consent choice plus that role. The open-source ramp-public/ramp_mcp repository was archived on 17 July 2026, so do not start on it. Checked 2026-11-06. - QuickBooks Online MCP server (intuit, Apache-2.0): create, read, update and delete tools across 29 entities and 11 reports. Set `QUICKBOOKS_DISABLE_WRITE`, `QUICKBOOKS_DISABLE_UPDATE` and `QUICKBOOKS_DISABLE_DELETE` to true so only the get and search tools register. Enforcing layer: tool registration in the server; the OAuth grant itself can still write, so prefer report exports. Checked 2026-11-06. - Xero MCP server (XeroAPI, MIT): includes invoice creation and management. Prefer report exports, or allow read tools only. Enforcing layer: connection scopes plus the client allowlist. Checked 2026-11-06. - Zylo MCP server: answers questions and can act (create contracts, update licence counts, reassign owners). Use an API key limited to reads; MCP permissions mirror the key. Checked 2026-11-06 against Zylo's post of 2026-07-14. Identity: - Okta Application Usage report: export only; 90 days of events. Checked 2026-11-06. - Microsoft Entra ID: sign-in and audit logs, 7 days on Free, 30 days on P1 and P2; reader roles; export only. App permission grants read through Microsoft Graph as a Directory Readers user. Checked 2026-11-06. - Google Workspace accessed apps CSV: download only (super administrator); never upload an edited file. Checked 2026-11-06. CRM: - HubSpot remote MCP server: all actions follow the connected user's permissions; there is no read-only switch, and HubSpot's permissions guide says users with View access can still create notes and tasks. Connect a least-privilege user and allow only read tools in the client. Checked 2026-11-06. - HubSpot exports: Export all users (Super Admins) and the Connected Apps page. Export only. Checked 2026-11-06. - Salesforce hosted MCP servers: connect to the `sobject-reads` server for User, profile and licence reads; no data changes are possible through it. Enforcing layer: the endpoint choice plus the profile and permission sets. Checked 2026-11-06. Analytics and ads: - Google Analytics MCP server (googleanalytics/google-analytics-mcp, Apache-2.0; 1.0.0 of 3 November 2026 is marked Production/Stable): read tools by default with the analytics.readonly scope; `create_property_annotation`, `create_custom_dimension` and `create_key_event` need `--allow-write` and analytics.edit, so never pass `--allow-write`. Checked 2026-11-06. - Google Ads MCP (googleads/google-ads-mcp): read tools `list_accessible_customers`, `search` and `get_resource_metadata`. Google's developer page still calls the server strictly read-only, but the repo README now lists mutating tools (`create_asset`, `upload_video_asset`, `manage_labels`, `manage_label_associations`) and says a strictly read-only deployment sets `labels: false` and `assets: false` in `tools_config.yaml`. Set both, and list the live tools before the first call. Enforcing layer: the tool config. Checked 2026-11-06. - Meta Ads MCP server: `ads_mcp_management` is the permission that opens the server, and Meta's permissions reference says it covers creating and managing campaigns as well as reports. No read-only mode is documented, so allow only reporting tools in the client, or use an Ads Manager export. Enforcing layer: the client allowlist. Checked 2026-11-06. Tags: - Stape GTM MCP server: local CLI with a Read-permission service account and `GTM_SCOPES` set to the tagmanager.readonly scope; confirm with `gtm_auth_status`. Checked 2026-11-06. Warehouse and pipelines: - Snowflake managed MCP server: SQL execution is read-only by default (`read_only` true allows SELECT only). MCP OAuth sessions use the connecting user's DEFAULT_ROLE as the primary role, so make the SELECT-only role that user's default and leave `OAUTH_USE_SECONDARY_ROLES` at NONE. Query ACCOUNT_USAGE.USERS and LOGIN_HISTORY. Checked 2026-11-06. - BigQuery remote MCP server: `execute_sql_readonly`, with `execute_sql` and `cancel_job` denied in the client and by an IAM deny policy on tools that are not read-only. The tool has no maximum bytes billed: dry-run first, then set `jobTimeoutMs` and a label, inside an agreed budget. INFORMATION_SCHEMA.JOBS covers 180 days. Checked 2026-11-06. - Fivetran MCP server (fivetran/fivetran-mcp, MIT): `FIVETRAN_SCOPE=read` plus the README's recommended denylist, under a limited Fivetran role. Checked 2026-11-06. Lifecycle and product analytics: - Klaviyo: the remote server's read-only setting, or the local server with `READ_ONLY=true` and a read-scoped private key. - PostHog: `?readonly=true` on the server URL (write tools leave the tool list). - Braze and Mixpanel: follow the dashboard user's or service account's permissions; use a user without edit rights. - Checked 2026-11-06. ## What never leaves as a live action Every change the audit proposes leaves as a draft for a person: a change list, a notice draft for the contract owner, a revocation list for an admin, or a register update awaiting approval. Writes through any of the tools above follow agent-write-safety, after explicit approval.