MCP governance, framework by framework

No framework certifies a protocol — they test your controls over your deployment. Each guide maps AI-agent tool calls onto one framework: the controls in scope, the question asked at audit, the default-setup gap, and the evidence a gateway produces for AI agent compliance.

SOC 2

Trust Services Criteria — logical access, monitoring, change management

ISO 27001

Annex A 2022 — access control, identity, logging, suppliers

HIPAA

Security Rule safeguards for agents touching ePHI

GDPR

Articles 25, 28, 32 — minimised, contracted, logged processing

PCI DSS

v4.0.1 Requirements 7, 8, 10 for payment-touching agents

EU AI Act

Deployer obligations by risk tier — literacy now, Art. 26 if high-risk

NIST AI RMF

GOVERN, MAP, MEASURE, MANAGE for agent fleets

DORA

ICT risk, Art. 9 access control, third-party register

Enforceable controls and audit evidence on every MCP call.

Per-person grants, deny-by-default policy and a per-call audit log — the evidence your framework asks for, on the MCP slice of your programme. Live in minutes.

TAKE YOUR AGENTS LIVE →

Instant setup, no code required.

46,500+ MCP servers and 515,000+ tools scanned and risk-classified.