# Production checklist for MCP workflows

Review credentials, permissions, limits, errors, data sources, client versions and owner responsibilities before a workflow goes live.

Canonical: https://aroai.com/resources/production-checklist/

## Before connecting

- Select the exact client product, version and transport.
- Confirm OAuth or API-key support and the workspace the client will use.
- Store secrets in the client's protected credential manager.
- Document the people who own and review the workflow.

## Before first live use

- Inspect every tool schema and cost rule.
- Confirm required source access, provider account and permitted use.
- Run an approved fixture first and label it as sample data.
- Test no-match, invalid input, auth denial, usage limit and upstream failure paths.

## During operation

- Refresh tool discovery after catalog changes.
- Monitor credit use and daily execution caps.
- Plan key rotation and client re-authentication.
- Record safe error codes and versions for support; exclude credentials and private records.

## Review changes

When a source, schema, client version or authorization boundary changes, rerun the workflow review and update its documented owner, assumptions and recovery steps.