diff --git a/manifest/overlays/production/dev-safe-vmcp.yaml b/manifest/overlays/production/dev-safe-vmcp.yaml
new file mode 100644
index 0000000..02c0af2
--- /dev/null
+++ b/manifest/overlays/production/dev-safe-vmcp.yaml
@@ -0,0 +1,28 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: VirtualMCPServer
+metadata:
+  name: dev-safe-vmcp
+  namespace: toolhive-system
+spec:
+  groupRef:
+    name: homelab-core
+  embeddingServerRef:
+    name: homelab-embedding
+  incomingAuth:
+    type: anonymous
+  config:
+    aggregation:
+      conflictResolution: prefix
+      tools:
+        - workload: gitea-mcp
+          toolConfigRef:
+            name: dev-tools
+        - workload: automem-remote
+          toolConfigRef:
+            name: dev-tools
+        - workload: argocd-mcp
+          excludeAll: true
+        - workload: kubernetes-mcp
+          excludeAll: true
+    optimizer:
+      maxToolsToReturn: 5
\ No newline at end of file
diff --git a/manifest/overlays/production/full-vmcp.yaml b/manifest/overlays/production/full-vmcp.yaml
new file mode 100644
index 0000000..7d6e83e
--- /dev/null
+++ b/manifest/overlays/production/full-vmcp.yaml
@@ -0,0 +1,17 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: VirtualMCPServer
+metadata:
+  name: full-vmcp
+  namespace: toolhive-system
+spec:
+  groupRef:
+    name: homelab-core
+  embeddingServerRef:
+    name: homelab-embedding
+  incomingAuth:
+    type: anonymous
+  config:
+    aggregation:
+      conflictResolution: prefix
+    optimizer:
+      maxToolsToReturn: 8
\ No newline at end of file
diff --git a/manifest/overlays/production/ops-safe-vmcp.yaml b/manifest/overlays/production/ops-safe-vmcp.yaml
new file mode 100644
index 0000000..860fb52
--- /dev/null
+++ b/manifest/overlays/production/ops-safe-vmcp.yaml
@@ -0,0 +1,28 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: VirtualMCPServer
+metadata:
+  name: ops-safe-vmcp
+  namespace: toolhive-system
+spec:
+  groupRef:
+    name: homelab-core
+  embeddingServerRef:
+    name: homelab-embedding
+  incomingAuth:
+    type: anonymous
+  config:
+    aggregation:
+      conflictResolution: prefix
+      tools:
+        - workload: gitea-mcp
+          excludeAll: true
+        - workload: automem-mcp
+          excludeAll: true
+        - workload: argocd-mcp
+          toolConfigRef:
+            name: ops-tools
+        - workload: kubernetes-mcp
+          toolConfigRef:
+            name: ops-tools
+    optimizer:
+      maxToolsToReturn: 6
\ No newline at end of file