Yes, an AI assistant can create tickets through an MCP server safely if the write tool is narrow, a person confirms it, inputs are validated, calls are rate limited and every call is logged. The MCP specification recommends exactly these controls for tools.
What the specification says
The Model Context Protocol tools page says there should always be a human in the loop with the ability to deny tool invocations, and that applications should make clear which tools are exposed, show indicators when tools are invoked, and present confirmation prompts. It says servers must validate all tool inputs, implement access controls, rate limit invocations and sanitize outputs. Clients should confirm sensitive operations, show tool inputs before calling the server, validate results, set timeouts and log tool usage for audit.
Why tickets are a good first write action
Creating a ticket is low impact and reversible. Closing a finding, changing a policy or merging code is harder to undo. Start with create and comment, and treat everything else as a later step.
Setup steps
- Create a service account for the MCP server with permission to create and comment on tickets in one project.
- Expose one tool, such as "create ticket", with a strict input schema: title, finding id, severity from a fixed list, and a body limit.
- Reject free form fields that could carry hidden instructions, and cap length.
- Require a confirmation prompt in the client, showing the exact title and body.
- Add a rate limit, for example a few tickets per hour per user.
- Add duplicate checking by finding id, so a retry or a confused assistant cannot file twenty copies. See duplicate tickets from repeated scans.
- Log every call with the user, the inputs and the result.
Risks to keep in mind
Text in a finding, a ticket or a web page can contain instructions aimed at the model. Treat all retrieved content as untrusted. A tool that can write is a tool an attacker would like to steer, which is another reason to keep scope small. See what excessive agency looks like in MCP tools.
Try it yourself
Open the demo to see an assistant working with Safeguard through MCP. Notice which actions are reads and which would change something.
Click through it at your own pace, or open it full screen.
Quick check
Should the assistant be able to close tickets too?
Not at first. Start with create and comment, add more only after reviewing logs, and keep a person confirming sensitive changes.
Who is responsible for validating tool inputs?
The server must validate them. The client should also show inputs to the user before calling.
Safeguard provides an MCP server and an MCP Guardrail, and you can try a free scan at gold.safeguard.sh/scan.
Sources
- Model Context Protocol, Tools specification
Last reviewed: 19 October 2026.
