A coding assistant should inspect a repository and propose changes, but its execution must not access unrelated host files or production credentials. Which approach best fits?

1. Configure an authorized MCP server with narrowly scoped capabilities.
2. Run it in an appropriately isolated development sandbox.
3. Package the procedure as a reviewed skill or reusable instruction artifact.
4. Add an enforced approval boundary before deployment actions.