MCP Governance Framework V1.0

Executive Summary

MCP (Model Context Protocol) is a new standard for connecting various data sources, enabling secure, orchestrated context sharing across agentic systems. It opens up new opportunities for financial services to leverage untapped data pools for analytics, personalization, and operational efficiency.

Over the past four months, our evaluations have confirmed that the standard MCP protocol does not fully align with the stringent security and compliance requirements of financial institutions. While the market is trending toward all‑in‑one solutions, we prioritize safeguards that meet industry expectations. As a result, we recommend our MCP Governance Framework that exceeds baseline MCP capabilities to ensure your organization’s regulatory compliance and risk management objectives are consistently met.

The Unique AI MCP Governance Framework is built on four core pillars:

• Human-in-the-loop
• Full Transparency
• Authentication and Access Control
• Approved Server Registry

This ensures prevention of unauthorized access, malicious servers, prompt injection attacks, and sensitive data exposure to enable financial services customers to integrate AI safely and meet regulatory requirements.

Our approach also aligns with Unique’s principles in our AI Governance Framework around Safety & Security, Accountability, Privacy, and is operationalized under ISO 42001 and our broader compliance stack, so customers in financial services can rely on resilient, compliant, and secure MCP integration.

Our objective is to deliver a secure, enterprise-ready MCP Hub that centralizes tool orchestration, prompt management, and policy enforcement for AI-assisted workflows. The solution provides granular access controls, integrates with enterprise DLP, and gives administrators full observability across usage, compliance, and performance.

Unique MCP Governance Framework: Built on four Pillars

Strong authentication, authorization, and governance, ensures customers decide step by step when and what they release via MCP.

Human in the Loop

• Explicit Client Approval: Within our MCP hub, user consent is fundamental—no MCP process can proceed without explicit client confirmation. Critical actions - whether standard execution, AI-assisted analysis, or complex tasks - require prior authorization. This prevents silent execution and protects against prompt injection attacks where malicious instructions could otherwise bypass controls.

• Client Authority & Control: The client maintains full decision-making power and governance over what happens in their environment and what is allowed to be happening by setting boundaries and permissions within their MCP Hub. Clients are always in control.

• Dynamic Information Elicitation: MCPs are designed to pause operations and seek user input when specific information is required, ensuring users stay in charge of what data is shared. Planned enhancements include content filtering mechanisms to further safeguard against inadvertent data disclosure.

Authentication and Access Control

• SAML/OIDC & SSO Integration: Authentication is managed through SAML or OpenID Connect protocols, enabling Single Sign-On with MFA so users authenticate once and securely access all connected systems within the Unique MCP Hub.

• SCIM Provisioning: User and group management can be automated through System for Cross-domain Identity Management (SCIM), to ensure access rights remain aligned with organizational roles and policies.

• OAuth Authorization: Authorization follows OAuth standards, to enable secure delegation of permissions without exposing credentials.

• Privilege Boundary Enforcement: MCPs operate strictly within the permissions of their authenticated user. An MCP cannot perform any action that the user themselves cannot perform based on their organizational privileges and role-based access controls.

Approved Server Registry

• Server Verification: Every MCP server must undergo verification and approval before being allowed to connect to the Unique.

• Connection Enforcement: Only servers present in the approved registry are allowed to establish connections. Unapproved servers are blocked at the connection level.

• Registry Management: Clients maintain control over their approved server registry, with the ability to add, remove, or modify which servers are permitted to operate and what actions they can perform within their environment.

• Approved Prompts & Actions: Each approved server has a pre-defined list of allowed prompts and actions. MCPs can only execute operations that are explicitly approved by Unique or the client.

Full Transparency

• Audit Logs: All MCP activities, tool calls, configuration changes, and user actions are logged with complete traceability, creating an immutable record that can be traced back to its source for investigation and accountability.

• Complete Visibility (planned): Clients have full visibility into what MCPs are doing, what data they're accessing, and how they're behaving. Every action can be reviewed and investigated.

• Compliance & Standards Alignment: The Unique MCP Hub is designed to meet SOC 2, ISO 27001, and ISO 42001 requirements for clients to demonstrate compliance and meet regulatory obligations.

• Full Traceback Capability(planned): Every tool call, configuration change, and operation can be traced back to its source, enabling root cause analysis, forensic investigation, and accountability.

• User Training & Support: Unique provides training and guidance to help clients understand their audit logs, leverage transparency features, and effectively manage their MCP environment.

Unique MCP Security Implementation

Security Best Practices

We implemented MCP security best practices according to the reference documentation of the MCP standard as described in https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices.

• Unique MCP always follows the OAuth flow per user and separates MCP server sessions from user sessions to prevent the confused deputy problem.

• Unique MCP separates MCP server sessions from user sessions to prevent token passthrough issues.

Authorization

Unique MCP servers implement OAuth 2.1 authorization, and Unique AI can work together with any MCP server that implements the standard OAuth 2.1 specification as outlined in https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization and https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization.

This document is a work in progress and will be updated regularly as our Unique MCP Hub evolves.