diff --git a/config/agent-safehouse/common.sb b/config/agent-safehouse/common.sb
index a59f735..5b92fad 100644
--- a/config/agent-safehouse/common.sb
+++ b/config/agent-safehouse/common.sb
@@ -26,3 +26,15 @@
 (allow file-read* file-write*
     (home-subpath "/.plannotator")
 )
+
+;; mcporter: scripts that call MCP servers through it read and refresh OAuth
+;; tokens in its vault here, and write
+;; schema caches, locks and daemon logs. The config is denied back: it names
+;; stdio server commands that run unsandboxed on the next mcporter call outside.
+(allow file-read* file-write*
+    (home-subpath "/.mcporter")
+)
+(deny file-write*
+    (home-literal "/.mcporter/mcporter.json")
+    (home-literal "/.mcporter/mcporter.jsonc")
+)
diff --git a/doc/adr/0060-agent-safehouse-wrapper.md b/doc/adr/0060-agent-safehouse-wrapper.md
index 7e84b71..4449a14 100644
--- a/doc/adr/0060-agent-safehouse-wrapper.md
+++ b/doc/adr/0060-agent-safehouse-wrapper.md
@@ -50,7 +50,9 @@ it (`safe pi`). It:
 The split between files follows role, not convenience:
 
 - `common.sb`: dotfiles' own symlink literals, agent `.pub` files and the
-  dedicated socket, and the plannotator pi extension.
+  dedicated socket, the plannotator pi extension, and mcporter's `~/.mcporter`
+  (vault and caches; its `mcporter.json[c]` config stays write-denied, since it
+  names commands that run unsandboxed later).
 - `role-work.sb`: everything Gusto- or pickleton-specific: `~/pickleton`
   read/write, pickletown config and dolt info file, `/pkg`, and the dotslash
   cache for Gusto's managed pi.