Read-only MCP keeps discovery separate from authority. A coding agent can search, retrieve and cite accepted engineering decisions, but changing those decisions still requires an explicit repository edit and human review.
Context access is a trust decision
MCP servers can expose resources, prompts and tools. Tools may perform actions, while resources provide context. A decision system should minimise the authority granted through the interface an agent uses automatically.
If the same convenient query surface can also rewrite accepted records, a model could alter the rule it is expected to follow. Separating reads from writes keeps that failure mode outside the normal agent loop.
Read-only does not prevent change
A team can still change any decision. The change happens as a visible repository diff with ownership, review and history. The MCP interface then reads the newly accepted state. This is slower than silent mutation by design: changing authority should be more deliberate than consulting it.
Stable citations improve review
A useful response returns record identifiers and enough source information for a reviewer to inspect the governing text. The agent can cite that record in its plan or pull-request description instead of paraphrasing an uncited answer from another model.
Keep actions in explicit workflows
Creation, supersession and import can be handled by separate commands or connectors whose outputs become proposed repository changes. This preserves automation while keeping the accepted decision behind the same review boundary as code.