🔌 OFFICIAL MCP RUNTIME SPECIFICATION

Model Context Protocol (MCP) Security Architecture

Standardized context exchange topology connecting AI Copilots to SIEM, vulnerability scanners (Tenable, Qualys), Jira SOAR tickets, and cloud isolation tools through typed JSON-RPC 2.0 dispatchers.

RFC SPEC: MCP v1.xModel Context Protocol Topology & Security Dispatcher

How Model Context Protocol (MCP) Functions in PosturePilot

Standardizes how AI Copilots discover security tools, inspect vulnerability resources, and execute deterministic remediation.

LAYER 1 • CLIENT HOSTMCP Client

🤖 AI Copilot & SOAR Agents

Frontier LLMs executing autonomous ReAct loops (Reasoning + Tool Acting) with cyclic state graphs.

🧠 Anthropic Claude 3.5 Sonnet

⚡ OpenAI GPT-4o / Gemini 1.5

🔄 LangGraph Multi-Agent Planner

Dispatches typed tools/call & queries resources/read

LAYER 2 • PROTOCOL SERVERJSON-RPC 2.0

🔌 PosturePilot MCP Server

Central runtime exposing verified schema tools, posture resources, and enforcing strict human approval gates.

📦 Tools Registry: Dynamic JSON Schema discovery

📂 Resources Provider: cve:// & posture:// URIs

🛡️ Human-in-the-Loop Policy Gate

Transport: Standard I/O (stdio) & Server-Sent Events (SSE)

LAYER 3 • TOOL DISPATCHERS5 Active Handlers

⚡ Deterministic Security Tools

Sandboxed execution units that interact directly with scanners, cloud providers, and ticketing systems.

Execution Lifecycle: How an MCP Security Tool is Called in PosturePilot

1. Tool Discovery

Copilot queries tools/list. MCP Server returns JSON Schema specs for all 5 security endpoints.

2. ReAct Decision

Agent formulates reasoning, builds typed input payload matching target tool schema, and issues tools/call.

3. Policy & Approval

If tool mutates state (e.g., AWS IAM isolation or Jira ticket), MCP Server halts and triggers CISO approval prompt.

4. Context Enrichment

Tool executes against downstream API, normalizes response into standard JSON-RPC envelope, and updates Posture score.