Scoping Credentials for a New MCP Server

Your team wants to connect Claude Code to your production PostgreSQL database via an MCP server, so engineers can ask natural-language questions about usage data during debugging sessions. Someone proposes the fastest path: point the server at the existing admin connection string already used by the ops dashboard, since it's already provisioned and has access to every schema.

1. Explain, mechanistically, what could go wrong with this setup — not "it feels risky," but the actual chain of events.
2. What credential would you provision instead, and why does it change the failure mode rather than just making it less likely?
3. A teammate argues "the model is well-behaved, it won't just run DROP TABLE for no reason." Explain why this argument misses the actual threat model.