MCP deployment with human approval: how Aria keeps AI agents safe

Giving an AI coding agent access to your production infrastructure is a superpower—right up until a hallucinated command drops a table or overwrites an environment variable.

Most teams respond to that risk in one of two ways: either they paste logs back and forth into the chat window by hand, or they hand the agent an unrestricted SSH key or API token and hope the system prompt behaves. Neither is good enough for production.

Aria is built around a simple rule: safety levels are enforced by Aria on the server, never by a prompt instruction to the AI. Over the Model Context Protocol (MCP), your coding agent (Claude Code, Cursor, Codex or Gemini CLI) can inspect your server, read logs and prepare deployments, while Aria gates every change behind three strict tiers: SAFE, CONTROLLED and DESTRUCTIVE.

Why prompt-only guardrails fail in production

Telling an LLM “please ask me before running destructive commands” in CLAUDE.md or .cursorrules is polite, not secure. When an agent is forty turns deep into debugging a failing build, context windows compress, instructions drift, and a well-meaning retry can trigger a restart or a schema change you never approved.

For AI-native infrastructure to be trustworthy, the platform has to enforce the boundary:

• The agent should never hold raw root SSH credentials when it only needs to read logs or propose a deploy.
• Read-only diagnostics should never block on human clicks, or debugging becomes slow.
• Mutations to live services and environment variables must pause until a human explicitly approves the exact action.
• Irreversible operations (deleting a database or tearing down a server) must require deliberate human confirmation where you type the resource name.

The three safety levels in Aria’s MCP server

Every tool exposed by Aria’s MCP server is classified at the protocol and API layer into one of three levels:

Safety level	In the UI	What it covers	How Aria enforces it
SAFE	Look (Green)	Reading server status, CPU/RAM metrics, build logs, runtime logs, service health and aria.yaml validation	Runs immediately with zero friction so your agent can diagnose issues at full speed
CONTROLLED	Change (Amber)	Deploying a service, restarting a container, updating environment variables, adding a domain or scaling a plan	Aria pauses the MCP tool call and sends an approval prompt to your Mac app or web dashboard; nothing runs until you click Approve
DESTRUCTIVE	Delete (Red)	Deleting a database, wiping a volume, removing a service or destroying a workspace server	Blocked until you personally type the exact name of the server or database to confirm

Because these checks live inside Aria’s API, an agent cannot bypass them by phrasing a request differently or passing a --force flag.

What a real debugging loop with Claude Code looks like

Suppose a new commit causes your API service to return 500 errors on production:

1. You ask Claude Code: “Check why the API is failing on Aria and fix it.”
2. SAFE (instant): Claude Code calls Aria’s MCP tools to check service health and tail the last 200 lines of build and runtime logs. Because reading logs is SAFE, Aria returns the stack trace immediately without interrupting you.
3. Local fix: Claude Code spots a missing environment variable or a query bug in your repository, edits the code or aria.yaml, and validates the stack file.
4. CONTROLLED (your approval): Claude Code requests a deployment via MCP. Your native Mac app (or web dashboard) chimes and displays the exact diff and action waiting for approval.
5. One-click ship (or two-second rollback): You click Approve. Aria builds, deploys and verifies health. If anything still looks wrong, rolling back to the previous image takes about two seconds.

Designing aria.yaml for agent-first operations

Aria pairs MCP runtime control with a single declarative file at the root of your repository: aria.yaml.

Instead of clicking through twenty dashboard screens to wire up a web app, a worker, Postgres, Redis and self-hosted Supabase, your coding agent inspects your codebase (package.json, Prisma/Drizzle schemas, Dockerfiles, .env.example) and writes aria.yaml for you. Aria then:

• Validates every service, port and database declaration.
• Estimates the total memory footprint in megabytes and recommends the smallest server plan that fits (starting from £8/month ex VAT, draft).
• Wires generated secrets and internal database URLs automatically so secrets never sit in your Git history or chat transcript.

FAQ

Which coding agents work with Aria’s MCP server?

Any coding agent that supports the Model Context Protocol (MCP), including Claude Code, Cursor, Codex and Gemini CLI, can connect to Aria to inspect stacks, draft aria.yaml files and request deployments.

Can an AI agent delete my database on Aria?

No. Database deletion and server teardown are classified as DESTRUCTIVE actions. Aria enforces a hard gate requiring a human user to type the exact resource name in the Mac app or web dashboard before any destructive action can execute.

Does my coding agent get root SSH access to my server?

No. Your agent talks to Aria’s structured MCP tools rather than holding raw root SSH keys. It can read logs and status freely (SAFE), propose deploys and config changes (CONTROLLED, requiring your approval), and never touches the underlying OS hardening.

Is MCP access included on every Aria plan?

Yes. Every Aria server plan—from Starter (£8/month ex VAT, draft) upwards—includes aria.yaml validation, memory estimation and MCP agent integration with no per-seat or per-agent fees.

Let your agent do the heavy lifting—safely

Read our guide to deploying with Claude Code, see how Aria compares to Vercel, Heroku and Supabase Cloud, or get started.