MCP Compliance Integration

MCP Compliance Integration

Overview

This skill secures Model Context Protocol (MCP) integrations used by the compliance agent. MCP servers expose tools (Playwright browser automation, Postgres queries, Slack notifications, Presidio DLP) to the agent runtime. Misconfiguration creates pathways for ePHI exfiltration, unauthorized CDE access, and unlogged actions.

Security baseline:

• OAuth 2.1 with PKCE for user-delegated MCP access
• Tool allowlists—principle of least functionality
• TLS 1.2+ for all MCP transport
• Structured audit logging without cleartext PHI (see audit-logging-integrity)
• BAA coverage for MCP operators processing ePHI (see hipaa-baa-vendor-assessment)

When to Use

Use this skill when:

• Deploying new MCP servers for compliance workflows
• Auditing existing MCP configurations (scopes, tools, network placement)
• Implementing OAuth 2.1 + PKCE for MCP authorization
• Defining tool sets per role (auditor vs read-only vs emergency)
• Integrating Playwright, Postgres, Slack, Presidio MCP patterns from this repository
• Incident response for compromised MCP tokens or rogue tools

Do not use this skill when:

• Writing PCI script inventory logic (use pci-dss-script-audit—references Playwright MCP)
• Presidio entity tuning without MCP (use hipaa-phi-redaction-pipeline)
• Enterprise vendor risk programs without MCP (use vendor-third-party-risk)

Core Process

Execute steps in order.

Step 1: MCP server inventory

1. List all MCP servers connected to compliance agent:

2. Document version, deployment location, network zone, BAA status.
3. Artifact: mcp-inventory-{id}.json.

Step 2: OAuth 2.1 and PKCE configuration

1. Register OAuth client per MCP server with:
   • Exact redirect URI allowlist (no wildcards)
   • Authorization code flow with PKCE S256 (OAuth 2.1 requirement)
   • Short-lived access tokens (≤1 hour) and refresh token rotation
2. Prohibit implicit flow and password grant.
3. Bind tokens to audience (specific MCP server resource identifier).
4. Test: authorization without PKCE challenge → must fail.

Step 3: Tool set design (least functionality)

For each MCP server, define role-based tool sets:

Playwright MCP pattern (PCI 6.4.3 / 11.6.1)

• Allowed tools: browser_navigate, browser_snapshot, browser_take_screenshot
• URL allowlist: payment page URLs only—block file://, internal IPs unless scoped
• Prohibited: arbitrary JavaScript execution beyond documented audit scripts
• Evidence: DOM snapshots stored with SHA-256; no PAN fields in stored HTML if avoidable

Postgres MCP pattern (baselines, evidence)

• Read-only role on compliance schema only
• Prohibited: DROP, UPDATE, production PHI/CDE tables
• Parameterized queries only; no arbitrary SQL from model without template allowlist
• Row limits on exports (e.g., max 10,000 rows)

Slack MCP pattern (SOC alerts)

• Channel allowlist: #soc-alerts, #compliance-audit—no DMs to personal accounts
• Message template: URL, diff summary, severity—no raw ePHI or PAN
• Prohibited: file uploads containing evidence bundles with PHI

Presidio MCP pattern (DLP)

• Mirror redaction.py entity types and thresholds
• Process locally where possible—avoid sending text to third-party Presidio SaaS without BAA
• Do not log input text in MCP server logs
• Fail closed if Presidio unavailable—agent must not bypass redaction

Step 4: Transport and network security

1. Enforce HTTPS/TLS 1.2+ for remote MCP; mTLS for sidecar deployments.
2. Place MCP servers in dedicated subnet; NSC rules per pci-dss-network-segmentation.
3. No MCP admin interfaces on public Internet without VPN/ZTNA.

Step 5: Authentication and session binding

1. Map MCP OAuth identity to agent session correlation_id.
2. Revoke tokens on session end.
3. Service-to-service MCP: use workload identity (SPIFFE, cloud IAM)—not static API keys in agent.py.

Step 6: Logging and monitoring

1. Log per tool invocation: timestamp, actor, tool_name, resource, result, correlation_id.
2. Exclude raw tool arguments containing PHI from logs—or encrypt at field level.
3. Alert on: new tool registered, auth failure spike, Postgres query outside allowlist.

Step 7: Deployment and change control (CC8)

1. MCP server updates via CI/CD with compliance-as-code-governance policy scans.
2. Pin MCP server versions; hash container images.
3. Require approval for tool manifest changes.

Step 8: Compliance testing

1. Negative tests:
   • Attempt disallowed URL in Playwright → deny
   • Attempt SQL write via Postgres MCP → deny
   • Attempt Slack post to non-allowlisted channel → deny
2. Positive tests: PCI script audit workflow end-to-end with evidence hashes.
3. Document results in mcp-security-test-{id}.json.

Common Rationalizations

Red Flags

• MCP server accepts connections without authentication
• Postgres MCP connected to production CDE or clinical database
• Playwright MCP without URL allowlist (arbitrary navigation)
• Slack MCP posting evidence with cleartext PHI
• OAuth redirect URI wildcard (https://*.example.com/callback)
• MCP server logs store full tool arguments
• New MCP tool added without change ticket and security review

Verification

• MCP inventory complete with operator, version, zone, and BAA status
• OAuth 2.1 + PKCE configured and negative-tested (no PKCE fails)
• Role-based tool sets documented and enforced server-side
• Playwright URL allowlist configured for payment audit URLs only
• Postgres MCP read-only on compliance schema; write paths prohibited
• Slack MCP restricted to allowlisted channels with PHI-free templates
• Presidio MCP aligned with redaction.py; fail-closed tested
• TLS/mTLS and network segmentation verified
• Tool invocation audit logs configured without cleartext PHI arguments
• Negative and positive security tests completed with hashed evidence