Answer
If I point a coding agent at this, can it overwrite or destroy my project?
The MCP server exposes project context and narrow write tools to a coding agent, and anything that generates code or destroys state is dry-run unless you pass an explicit apply flag (C-18) — so you can read the generated output before anything is written. It is stdio only and local only: there is no hosted or authenticated MCP endpoint, and the server inherits the authority of the process that starts it. Planning is separate from execution: a Solution Plan is a checked-in file with a contract and a canonical fingerprint, validated against a real inspection, so a plan written against a composition that has since moved reports itself stale (C-15). That is a document contract, not a planner and not a runtime — nothing executes a plan, and the validator refuses a plan that carries a command.
What the ledger says, word for word
Each entry below is copied from site/claims.json, where it is bound to the evidence that holds it — a test file, a document, or a named repository fact — and to the limitation that travels with it. The answer above summarises these; these are the claim.
C-18
The MCP server exposes project context and narrow write tools to a coding agent; anything that generates code or destroys state is dry-run unless you pass an explicit apply flag.
LimitStdio only, local only. There is no hosted or authenticated MCP endpoint, and the server inherits the local process's authority.
JTBD-AX-02tests/mcp.test.jstests/scaffold.test.jsdocs/MCP.mdC-15
A Solution Plan is a checked-in file with a contract and a canonical fingerprint, validated against a real inspection — so a plan written against a composition that has since moved reports itself stale.
LimitA document contract, not a planner and not a runtime. Nothing executes a plan, and the validator refuses a plan that carries a command.
JTBD-AX-03tests/solution-plan.test.jsdocs/SOLUTION_PLAN.mdWhere this stops
Nothing on this page implies deployment readiness. The framework ships no authentication verifier; authorization is framework-enforced; tenant isolation is one tenant per application instance, not shared-database row tenancy. Read the exact repository posture before deployment. Every claim and every limitation is on one page, and the questions this project refuses to answer are published beside them.