Skip to the rows

agentsclimarketplace

Mcp compliance integration

Skill vaquarkhan/compliance-agent-skills/skills/mcp-compliance-integration

30 Agent Skills for deterministic USA compliance auditing of AI agents — HIPAA, NIST AI RMF, FERPA, COPPA, PCI-DSS, SOC 2, FedRAMP, CMMC, GLBA, privacy & GDPR. Presidio PHI redaction, MCP templates, Pydantic AI, VS Code & JetBrains plugins.

Install

npx -y skills add vaquarkhan/compliance-agent-skills --skill mcp-compliance-integration

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Hardens Model Context Protocol (MCP) server integrations for compliance—OAuth 2.1, PKCE, scoped tool sets, transport security, and patterns for Playwright, Postgres, Slack, and Presidio MCP servers in audit workflows. Trigger when deploying, configuring, or auditing MCP servers for HIPAA, PCI, or SOC 2 agent architectures. Do not use for general IAM reviews without MCP focus (use access-control-identity-audit) or PCI script DOM audits (use pci-dss-script-audit).

SKILL.md

7.8 KB, as published. Nobody here has run it

MCP Compliance Integration

Overview

This skill secures Model Context Protocol (MCP) integrations used by the compliance agent. MCP servers expose tools (Playwright browser automation, Postgres queries, Slack notifications, Presidio DLP) to the agent runtime. Misconfiguration creates pathways for ePHI exfiltration, unauthorized CDE access, and unlogged actions.

Security baseline:

OAuth 2.1 with PKCE for user-delegated MCP access
Tool allowlists—principle of least functionality
TLS 1.2+ for all MCP transport
Structured audit logging without cleartext PHI (see audit-logging-integrity)
BAA coverage for MCP operators processing ePHI (see hipaa-baa-vendor-assessment)

When to Use

Use this skill when:

Deploying new MCP servers for compliance workflows
Auditing existing MCP configurations (scopes, tools, network placement)
Implementing OAuth 2.1 + PKCE for MCP authorization
Defining tool sets per role (auditor vs read-only vs emergency)
Integrating Playwright, Postgres, Slack, Presidio MCP patterns from this repository
Incident response for compromised MCP tokens or rogue tools

Do not use this skill when:

Writing PCI script inventory logic (use pci-dss-script-audit—references Playwright MCP)
Presidio entity tuning without MCP (use hipaa-phi-redaction-pipeline)
Enterprise vendor risk programs without MCP (use vendor-third-party-risk)

Core Process

Execute steps in order.

Step 1: MCP server inventory

List all MCP servers connected to compliance agent:

Server	Package/source	Data sensitivity	Operator
Playwright	`@playwright/mcp`	URLs, DOM (may contain PHI in page)	Self/hosted
Postgres	Official/community postgres MCP	Query results (PHI/CDE risk)	Self/hosted
Slack	Slack MCP	Messages (notification only)	Vendor
Presidio	Custom/REST wrapper	Raw text (PHI)	Self/hosted

Document version, deployment location, network zone, BAA status.
Artifact: mcp-inventory-{id}.json.

Step 2: OAuth 2.1 and PKCE configuration

Register OAuth client per MCP server with:
- Exact redirect URI allowlist (no wildcards)
- Authorization code flow with PKCE S256 (OAuth 2.1 requirement)
- Short-lived access tokens (≤1 hour) and refresh token rotation
Prohibit implicit flow and password grant.
Bind tokens to audience (specific MCP server resource identifier).
Test: authorization without PKCE challenge → must fail.

Step 3: Tool set design (least functionality)

For each MCP server, define role-based tool sets:

Playwright MCP pattern (PCI 6.4.3 / 11.6.1)

Allowed tools: browser_navigate, browser_snapshot, browser_take_screenshot
URL allowlist: payment page URLs only—block file://, internal IPs unless scoped
Prohibited: arbitrary JavaScript execution beyond documented audit scripts
Evidence: DOM snapshots stored with SHA-256; no PAN fields in stored HTML if avoidable

Postgres MCP pattern (baselines, evidence)

Read-only role on compliance schema only
Prohibited: DROP, UPDATE, production PHI/CDE tables
Parameterized queries only; no arbitrary SQL from model without template allowlist
Row limits on exports (e.g., max 10,000 rows)

Slack MCP pattern (SOC alerts)

Channel allowlist: #soc-alerts, #compliance-audit—no DMs to personal accounts
Message template: URL, diff summary, severity—no raw ePHI or PAN
Prohibited: file uploads containing evidence bundles with PHI

Presidio MCP pattern (DLP)

Mirror redaction.py entity types and thresholds
Process locally where possible—avoid sending text to third-party Presidio SaaS without BAA
Do not log input text in MCP server logs
Fail closed if Presidio unavailable—agent must not bypass redaction

Step 4: Transport and network security

Enforce HTTPS/TLS 1.2+ for remote MCP; mTLS for sidecar deployments.
Place MCP servers in dedicated subnet; NSC rules per pci-dss-network-segmentation.
No MCP admin interfaces on public Internet without VPN/ZTNA.

Step 5: Authentication and session binding

Map MCP OAuth identity to agent session correlation_id.
Revoke tokens on session end.
Service-to-service MCP: use workload identity (SPIFFE, cloud IAM)—not static API keys in agent.py.

Step 6: Logging and monitoring

Log per tool invocation: timestamp, actor, tool_name, resource, result, correlation_id.
Exclude raw tool arguments containing PHI from logs—or encrypt at field level.
Alert on: new tool registered, auth failure spike, Postgres query outside allowlist.

Step 7: Deployment and change control (CC8)

MCP server updates via CI/CD with compliance-as-code-governance policy scans.
Pin MCP server versions; hash container images.
Require approval for tool manifest changes.

Step 8: Compliance testing

Negative tests:
- Attempt disallowed URL in Playwright → deny
- Attempt SQL write via Postgres MCP → deny
- Attempt Slack post to non-allowlisted channel → deny
Positive tests: PCI script audit workflow end-to-end with evidence hashes.
Document results in mcp-security-test-{id}.json.

Common Rationalizations

Excuse the agent might generate	Required rebuttal
"MCP is local, OAuth is unnecessary overhead."	Local MCP still processes sensitive data—authentication and tool allowlists prevent lateral abuse from compromised agent.
"Postgres MCP needs write for convenience."	Write access to evidence DB must use separate controlled pipeline—not general MCP write tools.
"Slack alerts need full DOM for context."	Full DOM may contain PHI/PAN—send diff summaries and artifact IDs only.
"PKCE is optional for confidential clients."	OAuth 2.1 mandates PKCE for all clients—including confidential.
"We trust the model to pick safe tools."	Models are not authorization layers—enforce tool sets server-side.
"Presidio MCP can fall back to no redaction."	Fail closed—unredacted PHI to LLM is a critical violation.

Red Flags

MCP server accepts connections without authentication
Postgres MCP connected to production CDE or clinical database
Playwright MCP without URL allowlist (arbitrary navigation)
Slack MCP posting evidence with cleartext PHI
OAuth redirect URI wildcard (https://*.example.com/callback)
MCP server logs store full tool arguments
New MCP tool added without change ticket and security review

Verification

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.