DPO Radio
MCP Connector | Forseti AI
MCP CONNECTOR
Bring Forseti to Your Existing AI Workflow Through the Model Context Protocol
External Claude clients – Anthropic Console, Claude Code, custom Slack bots, vendor-onboarding automations – call Forseti's tool surface over MCP using bcrypt-hashed per-organisation API keys. Every external write proposal lands in an in-product approval queue.
Why MCP Connector Matters
Most compliance teams have built a working pattern around an external AI assistant; a privacy engineer who lives in Claude Code, a regulatory analyst who opens Anthropic Console for cross-framework research, a compliance Slack bot the team has trained to triage questions. An AI legal advisor that does not meet those teams where they already work loses adoption.
The MCP Connector lets Forseti meet the customer where they already work. Three integration patterns are available. The Anthropic Console pattern issues a key with the regulatory-search and document-read tools only, an analyst opens Claude in the Console and asks "What does GDPR Article 30 require?", and the response is grounded in the org's installed regulatory packs, not in the model's training data. The Claude Code pattern issues a key with read tools plus a small write surface, a privacy engineer drafts a new DPIA from inside the IDE, and the proposed write lands in the in-product approval queue for the DPO to approve. The custom Slack bot pattern issues a key with the memory and persona-handoff tools, the bot provides relevant organisation context for compliance Q&A.
The approval queue is the load-bearing piece. External Claude clients propose writes; the proposal lands in an in-product approval queue with a 24-hour expiry; the admin reviews the preview, the arguments, and the requesting key's prefix; approve executes the tool with the API-key holder's resolved permissions; decline marks the proposal declined and the tool never runs; an hourly sweep clears unaddressed proposals after 24 hours.
MCP Connector Features
MCP Connector Overview
How the connector fits, what it exposes, and what it refuses to do
The connector exposes a defined set of Forseti tools over MCP. Read tools (regulatory search, document search, document read, module record search, framework conflict detection, workflow search) and memory tools are read-only. Write tools (propose edit, attach evidence, generate DOCX, create task, bulk create tasks, convert chat to workflow run) require approval queue confirmation before they execute.
- Tool surface exposed over MCP
- Read tools are read-only; write tools require approval
Issuing API Keys
Bcrypt-hashed per-organisation API keys with per-key tool whitelist
Admins issue keys from a dedicated MCP Keys surface. The plaintext key is displayed exactly once at issuance and bcrypt-hashed at rest. Per-key tool whitelist scopes which tools the key can call. Rotation has a 5-minute grace window so the rotation does not break in-flight integrations. Permission-gated; only admins with the MCP-keys permission can issue, rotate, or revoke.
- Plaintext key displayed once at issuance, bcrypt-hashed at rest
- Per-key tool whitelist. 5-minute grace window on rotation
Read Tools
Regulatory search, document read, record search – exposed over MCP
The read-tool surface lets external clients run grounded queries against the customer's installed regulatory packs and own records. Inline citations are returned with every match. Read tools cannot mutate any state.
- Regulatory search with inline citation
- Cross-module record search. Framework conflict detection
Write Tools
Propose edit, attach evidence, generate DOCX, create task – gated by the approval queue
Write tools propose state changes; they do not execute autonomously. The proposal lands in the in-product approval queue with a 24-hour expiry. The admin reviews the preview and approves, declines, or lets the proposal expire.
- Per-write proposal preview
- 24-hour expiry on pending proposals
Approval Queue
The load-bearing human gate for every external write proposal
Every external write proposal lands in the in-product approval queue. The admin reviews the preview, the arguments, and the requesting key's prefix. Approve executes the tool with the API-key holder's resolved permissions; decline marks the proposal declined and the tool never runs; an hourly sweep clears unaddressed proposals after 24 hours. Five audit events fire across the lifecycle – proposed, approved, executed, declined, expired – stitched together by a shared proposal identifier.
- Per-proposal preview, arguments, key prefix
- 24-hour expiry on unaddressed proposals
Permission Scoping
Per-key tool whitelist plus the API-key holder's permission set
A key's tool whitelist defines which tools the key can call. The approval-queue execution layer applies the API-key holder's permission set on top, even if the key can call propose_edit, the underlying record edit only commits if the key holder has the corresponding write permission on that record type. Two gates, layered.
- Tool whitelist defines what the key can call
- Underlying permissions decide what executes
Audit & Observability
Every MCP call in the IAT chain with a Source filter chip
Every MCP call – read, write proposal, write execution, write decline, write expiration – flows through the same Immutable Audit Trail as the rest of the platform. The Audit Trail page carries a Source filter chip that isolates MCP traffic. The Forseti Audit Lineage view shows per-chat and per-workflow lineage with MCP-initiated steps inline.
- All MCP events in the IAT chain
- Source filter chip on the Audit Trail page
Troubleshooting
Common errors, common fixes, and how to read the lineage
The troubleshooting surface covers the common errors integrators see (expired keys, scope-mismatched tool calls, exhausted token bucket, declined proposals) and the corresponding fixes. The lineage view is the canonical source of truth for what happened.
- Common error patterns and fixes
- Lineage view as canonical source of truth
Use Cases
Anthropic Console, Claude Code, Slack bot, custom integration
The three primary integration patterns available: Anthropic Console as a regulatory-research surface; Claude Code as a DPIA-drafting assistant; custom Slack bot for compliance Q&A. Each pattern has a recommended tool scope, a recommended persona, and a typical adoption profile.
- Three primary patterns available
- Recommended scope per pattern
WHAT FORSETI WILL NOT DO
The constraints are the product.
The features ride on top.
Built for Trust.
Every guardrail is intentional.
Nothing is left to chance.
Designed for Audit.
Every decision is traceable.
Every action leaves a trail.
Bypass Approval
No external write executes without approval-queue confirmation. Trusted keys cannot bypass review.
Delete Records
No deletion tool is exposed. Records cannot be deleted through any connector key or permission scope.
Approve Evidence
No tool can approve AI-generated evidence. Approval is always enforced as a human action.
Cross Boundaries
Every key is scoped to one organisation. Cross-organisation tool calls are impossible by design.
See MCP Connector in Action
Ready to see a Claude Code session draft a DPIA against your installed regulatory packs, with the proposed write landing in your approval queue? Request a personalised demo.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Next Steps
Start a Compliance Pilot
Issue an MCP key with the read tools only and run a 30-day pilot against an Anthropic Console session. Then expand to a write-capable key for Claude Code with the approval queue enabled.
Discuss Your Compliance Needs
Talk to our team about which integration pattern fits your team's existing AI workflow and which tool scope is the right starting point.
Frequently Asked Questions About Forseti MCP Connector
MCP is the Model Context Protocol; an open protocol Anthropic publishes for connecting AI assistants to external tools and data sources. Forseti exposes a defined set of compliance tools over MCP so external Claude clients (Anthropic Console, Claude Code, custom integrations) can call grounded queries against the customer's installed regulatory packs and own records.
A key can propose changes via the write tools. The proposed change does not execute until an admin approves it in the in-product approval queue. There is no "trusted key" mode that bypasses the queue; every external write is human-gated. Read tools are read-only and do not require approval.
Plaintext keys are displayed exactly once at issuance and bcrypt-hashed at rest. The platform does not retain a recoverable plaintext after the issuance step. Rotation has a 5-minute grace window so in-flight integrations do not break mid-rotation.
Pending write proposals have a 24-hour expiry. An hourly sweep clears unaddressed proposals after the expiry. The expiry is recorded as an audit event so the lifecycle is traceable. Expired proposals do not execute; the proposing integration receives a structured response.
No. Each key has a tool whitelist that defines which tools it can call. Tools outside the whitelist return a scope-mismatch error. Even within the whitelist, the underlying permission set of the API-key holder is applied at execution, the key holder must have the corresponding permission on the record type for a write to commit. Two gates, layered.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
