Where it runs
The MCP server is hosted in the AWS Sydney region (ap-southeast-2). Customer data processed through a tool call does not leave Australia. The hosted endpoint is mcp.ironbarkaml.com.au.
How your agent authenticates
Access uses OAuth 2.1 with Dynamic Client Registration, so each customer gets its own scoped token. Clients discover how to authenticate through RFC 9728 Protected Resource Metadata at /.well-known/oauth-protected-resource. An unauthenticated call to the MCP endpoint returns a 401 that advertises that metadata location, so a compliant client can self-configure without a support ticket.
The tool catalog
Ten tools ship at launch: nine low and medium risk, and one high-risk tool that always requires human approval. Each tool carries a risk class that drives its consent flow. Tools whose result drives a decision about a person carry an automated-decision disclosure (see below).
| Tool | Risk | Consent | ADM |
|---|---|---|---|
check_abnLook up and validate an Australian Business Number. | Low | Silent | Yes |
compute_trust_scoreReturn the 0 to 100 Trust Score for an entity. | Low | Silent | Yes |
list_recent_checksRead back the caller's own recent checks. | Low | Silent | No |
query_sanctions_matchScreen a name and date of birth against consolidated sanctions lists. | Low | Silent | Yes |
get_pep_statusReturn politically-exposed-person status for a name. | Low | Silent | Yes |
export_pdf_reportExport a prior check as a PDF report. | Low | Silent | No |
flag_high_risk_clientRecord an internal high-risk flag against an entity. | Medium | Confirm once per session | Yes |
subscribe_monitoringOpt an entity into ongoing monitoring. | Medium | Confirm once per session | No |
unsubscribe_monitoringCancel an existing monitoring subscription. | Low | Silent | No |
submit_smr_to_austracSubmit a Suspicious Matter Report. Always queued for human approval before anything is sent. | High | Human review (HITL) | Yes |
Consent and human review
Low-risk reads run silently. Medium-risk tools that change state ask for a one-time per-session confirmation. The single high-risk tool, submit_smr_to_austrac, never fires automatically. It queues into a human review queue with a 4-hour service level, and a person must approve before any Suspicious Matter Report leaves the system.
What every call costs, and the cap
Pricing is a $50 per month base that includes 20 free checks, then $5 per check, capped at $500 per month so a runaway agent cannot bill you without limit. The regulator-mandated SMR submission is $25 per submission. Every metered call is recorded against your monthly meter, and the cap is enforced before the tool runs, not after.
Your audit log, queryable by you
Every tool call writes exactly one immutable audit event. You can read your own events back through GET /mcp/audit, scoped so you only ever see your own activity. Records are retained for seven years to match Australian AML record-keeping. We never store raw tool arguments: each event keeps a SHA-256 digest of the inputs, so an auditor can prove which inputs produced an outcome without the audit store becoming a store of personal information.
Automated-decision disclosure
Any tool whose result drives a decision about a person carries an automated-decision disclosure on every response, not just in the tool listing. The disclosure travels in the response metadata so your agent can surface it to the user: what kind of decision it is, whether it can be appealed, and where to read how it works. This is part of the contract ahead of the Privacy Act 2024 automated-decision obligations that take effect 10 December 2026.
Threat screening before execution
Every tool call is screened before the tool runs. The screen looks for prompt-injection and data-extraction attempts in the request, and for behavioural patterns such as runaway call loops or rapid cost accumulation. Detections are recorded. Categories promoted to blocking are refused before execution; the rest are logged so we can tune thresholds without disrupting legitimate use.
Client compatibility
The server negotiates the MCP protocol version with each client and is tested against the five priority clients: Claude Desktop, ChatGPT Desktop, Cursor, Cline, and VS Code. A conformance suite runs in our build, so a client breaking the catalog is caught before release.
Sub-processors and AI
The MCP surface relies on the same sub-processors as the rest of the platform (including Anthropic for any model-touched work and Stripe for metering). The current list, with what each one receives, is at /security/subprocessors. How we use AI, and whether your data trains any model (it does not), is at /security/ai.
Certification
SOC 2 Type I attestation begins on our first enterprise customer (targeted 2026-Q4). SOC 2 Type II observation starts 2026-12-01 and runs a 12-month window to attestation on 2027-12-01. The full certification calendar lives at /security/roadmap. The MCP launch date is separate from any certification date: launch is when the tools go live, not a claim of attestation.
Vulnerability disclosure
Found a problem with the MCP surface? Email security@ironbarkaml.com.au or use /.well-known/security.txt. We acknowledge within 2 business days and credit you (with consent) at /security/disclosure after a fix.
Last reviewed: 2026-05-22.
Next review: 2026-08-22.
Platform security posture: /security.
Source policies and control library (public, CC BY 4.0): ironbark-portfolio-policies