MCP server for the Accela Civic Platform — safe-by-default, read-only out of the box, with opt-in write groups for records, inspections, documents, workflow, and payments. Encrypted token storage, dry-run writes, YAML kill-switch.