Skip to main content

Use cases

Most software team workflows end up falling into half a dozen patterns — someone opens a PR and needs to audit it; someone is about to write sensitive code and wants it grounded in a manual; someone starts a new repo and wants alignment from the outset. Rather than reinventing the use of the MCP each time, this section gathers tested recipes, each one already designed around what is typically wanted.

Every recipe has the same skeleton:

  • When to apply — trigger signal for the agent
  • MCP call sequence — tools, resources, prompts in the correct order
  • Output discipline — format, IDs to cite, anti-patterns to avoid
  • Skill / subagent file — snippet ready to save in the client

Choose the case that most resembles the work at hand today:

PR audit

Automated review of Pull Requests against the active controls of the project's risk_level — findings citable by CTRL-*.

reviewPRCTRL-*

Grounded codegen

Generate code with prepare_sbd_toe_codegen_context — branching by status (ready / input / clarification / decomposition / unsupported) and citations discipline.

codegencitationssecurity_rationale

Threat modelling

Combine get_threat_landscape + consult_security_requirements by concern (auth, api, encryption…) to produce grounded threat models.

threatsSTRIDEconcerns

Governance bootstrap

Apply plan_sbd_toe_repo_governance to a new repo — list of artefacts by chapter and automatic scaffold.

governanceartefactosbootstrap

Onboarding by role

get_guide_by_role(risk_level, role) to generate a personalised onboarding guide — practices by SDLC phase, user stories joined.

onboardingrolestraining

Normative cross-check

Cross-reference SbD-ToE with CRA, DORA, NIS2, GDPR, AI Act and ENISA/CSA via MCP — the published cross-checks, indexed in the served snapshot (see sbd://toe/version).

complianceAI ActCRADORA

Agentic SDLC via MCP

How the MCP supports each stop of the end-to-end agentic process — from mandate to kill-switch — with the right tool for each decision.

agenticSDLCmandateeval-suite

How to read each recipe​

💡 The Agentic SDLC via MCP case is the operational view of the end-to-end agentic process (cross-cutting cross-check). They are coupled but separate — the regulatory view lives in the cross-check, the MCP usage view lives here.

Each page follows the same structure:

  1. Scenario — a concrete situation in prose.
  2. Prerequisites — risk level + role + installed skill.
  3. Flow — sequence of MCP calls (with expected input/output).
  4. Output discipline — format of the final report + epistemic labels.
  5. Skill / subagent snippet — text ready to save (.claude/skills/..., .github/copilot-instructions.md, …).
  6. Anti-patterns — what not to do.

Shortcuts by risk level​

Risk levelTypical priority cases
L1Governance bootstrap · Onboarding
L2PR audit · Grounded codegen · Threat modelling
L3All of the above + Normative cross-check

Shortcuts by role​

RolePriority use case
developerGrounded codegen
appsec-engineerPR audit · Threat modelling
arquitetos-softwareThreat modelling
grc-compliance / auditoresNormative cross-check · Governance bootstrap
scrum-masterOnboarding