Install the server safely
Create an API key named for the MCP client and environment, then run the @quick-desk/mcp package from the client's server configuration. Provide the key through QUICKDESK_API_KEY, not a prompt or shared project file. The server uses https://api.quickdesk.co.uk unless QUICKDESK_API_BASE points it at another deployment.
Start read-only
Call quickdesk_whoami, then try a harmless list or search tool. Confirm the reported workspace and role before allowing the client to update tickets or tasks.
Control agent actions
Customer replies are not exposed unless QUICKDESK_MCP_ALLOW_SEND=1 is set for the server. Leave it unset until the workflow genuinely needs sending, and review every state-changing tool call. Revoke the key if the client is lost, misconfigured, or no longer required.