> ## Documentation Index
> Fetch the complete documentation index at: https://docs.p36-csq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Customer Trust Summary

> A one-page summary for customer security and QA teams evaluating the CSQ MCP server connection.

## What stays on your side

These items never leave your device or network:

* **Your source code** — the AI assistant reads your repository locally in your IDE.
* **Your prompts** — everything you type into the AI assistant stays inside your IDE.
* **The AI-generated draft** — the draft is written to a local JSON file in your workspace.
* **The import decision** — only a human user imports the approved JSON into the CSQ Cockpit.

## What the server actually does

The server exposes only two things:

1. **Read-only catalog tools** — list your tenant’s services, features, service instances, use-case schema, example, and risk rubric.
2. **Staged guidance prompts** — text instructions that tell the AI assistant how to structure the local risk-assessment draft. The main entry prompt is `start_usecase_discovery`. The flow is advanced through the `advance_analyze_btp_usage_flow` tool in six explicit stages:

| Stage | Title                                 | What the AI assistant is instructed to do                                           |
| ----- | ------------------------------------- | ----------------------------------------------------------------------------------- |
| 1     | Discover scope and evidence sources   | Inventory the codebase and collect use-case header fields.                          |
| 2     | Map services, features, and instances | Map observed usage to the tenant catalog.                                           |
| 3     | Apply risk and assemble the export    | Assess risk and build the export without finalizing it.                             |
| 4     | Write the final JSON file             | Write the UseCaseExport to a local JSON file in the workspace.                      |
| 5     | Validate the written JSON file        | Validate the file against the schema before presenting it.                          |
| 6     | Next steps: review and import         | Tell the user to review the local JSON and import it manually into the CSQ Cockpit. |

There is no tool to upload, submit, write, or execute anything. The server cannot run commands on your machine or modify data in CSQ.

## What crosses the wire

| Direction           | Data                                              | Example                                                      |
| ------------------- | ------------------------------------------------- | ------------------------------------------------------------ |
| **To the server**   | Bearer token + tool name + tool arguments         | `list_features_for_service`, `referenceServiceTid="svc-123"` |
| **From the server** | Structured tenant catalog data + guidance prompts | Service names, feature names, risk-model guidance            |

No source code, prompts, or generated drafts are transmitted.

## Read-only proof points you can verify

1. **No write-back tool.** The `src/tools/` directory contains only read-only tools. There is no `submit`, `upload`, `import`, or `write` tool.
2. **Local output instruction.** The staged prompt (`src/prompts/analyzeBtpUsage.ts`) explicitly instructs the AI assistant to write the draft to a local JSON file and not import it into CSQ until the user approves.
3. **Sanitized output.** Every database response is sanitized before serialization (`src/security/sanitizeOutput.ts`) to strip control characters and neutralize prompt-injection markers.
4. **Tenant isolation.** A token resolves to exactly one tenant database. Cross-tenant requests are rejected before reaching the database.

## Responsibility split

| P36                                             | Customer                                    |
| ----------------------------------------------- | ------------------------------------------- |
| Operate the server instance and protect secrets | Protect the tenant API token                |
| Provide read-only tenant data                   | Operate the AI assistant and IDE locally    |
| Enforce authentication and tenant isolation     | Review the local JSON draft                 |
| Maintain host, TLS, and DB hardening            | Import the approved draft into CSQ manually |

## Bottom line

Connecting the CSQ MCP server exposes **no source code, no prompts, and no write capability**. The only data that crosses the boundary is structured tenant catalog data that you already own. You remain in control of the AI assistant, the generated draft, and the final import decision.