Skip to content

MCP privacy, access control and data transforms

From docs/MCP_PRIVACY.md on GitHub

This is the reference for the policy engine behind the cloudg MCP layer (version 0.6.0): who may call what, how fast, and what happens to every byte of cloud data on its way to a model and back. It is written for programmers who deploy the server, write policies, or add tools to the catalog.

Related documents:

  • MCP.md is the user guide: installing, cloudg mcp serve, transports, client configuration and the adapters.
  • MCP_INTERNALS.md covers the layer, the registry, middleware and the native server.
  • MCP_TOOLS.md is the catalog of tools, resources and prompts, with each primitive's category, sensitivity and capabilities.

The code lives in cloudg/mcp/policy.py, cloudg/mcp/policies/*.yaml, cloudg/mcp/transforms/, cloudg/mcp/catalog/privacy.py and the parts of cloudg/mcp/layer.py and cloudg/mcp/middleware.py that apply it.

Sections

  • 1. Reproducing the examples

    Every output in this document was produced by running the code, not written by hand. The data is the synthetic estate in tests/mcp/fixtures/sample_estate.py...

  • 2. Threat model and goals

    cloudg holds an inventory of cloud estates: account IDs, ARNs, IP plans, IAM relationships, security findings and whatever metadata the collectors copied...

  • 3. What the policy touches

    The layer (cloudg/mcp/layer.py) runs the caller's output pipeline over everything that carries data out, and the input pipeline over everything that carries...

  • 4. Built-in profiles

    Seven profiles ship in cloudg/mcp/policies/. standard is the default.

  • 5. Loading and composing policies

    CloudGMCPLayer(policy=...) accepts anything Policy.load() accepts:

  • 6. Policy schema reference

    A policy has every field of AccessRules (6.2) plus:

  • 7. Access decisions

    Policy.decide(spec, principal) returns (allowed, reason):

  • 8. Principals and roles

    A Principal has an id, a set of roles and free attributes. Policies key off the roles and, optionally, the id.

  • 9. Rate limits

    Each RateLimitConfig is a token bucket. A bucket starts full at burst tokens (default ceil(rate)), refills at rate / period tokens per second, and a call...

  • 10. How pipelines are assembled

    A transform is named by a string or described by a mapping:

  • 11. Transform reference

    Cloud strings are attacker-influenced. sanitize walks every string value (and strips dict keys) and, in this order:

  • 12. Detectors

    The detection model follows Microsoft Presidio and Google Cloud DLP: a detector only reports spans of an entity type with a confidence; the strategy is the...

  • 13. The token vault

    TokenVault (cloudg/mcp/transforms/vault.py) turns values into pseudonyms and back. Each Policy owns one, built from vault:, unless one is passed in...

  • 14. Privacy tools and resources

    All are in category privacy and reach the policy through ctx.layer.policy.

  • 15. Auditing

    There are two independent trails: the policy's own decision log, and the JSONL middleware.

  • 16. Performance

    Measured on an AMD Ryzen 7 5800H with Python 3.13.13, on a machine that was running other jobs at the same time (load average around 5). Each bulk figure...

  • 17. Recipes

    All of these were run against the sample estate.

  • 18. Known gaps in 0.6.0

    These are behaviours of the current code that a policy author should know about. Each was reproduced against the code while writing this document; the...