Hardening MCP for SOC 2 and HIPAA Enterprise Workflows

graph LR
    subgraph Protected Enterprise Enclave
        DB[(PostgreSQL / Epic EHR)] --> RawData[Raw Record: Patient Data]
        RawData --> Sanitizer[PII / PHI Masking Engine]
        Sanitizer --> MaskedData[Tokenized / Redacted Context]
    end

    MaskedData --> Proxy[MCP Reverse Proxy]
    Proxy --> WORM[Immutable Audit Vault: S3 Object Lock]
    Proxy --> Agent[AI Agent Context: Cursor / Claude]

{
  "jsonrpc": "2.0",
  "id": "query-781",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Found Patient record: John Doe, SSN: 000-12-3456, DOB: 1984-05-12, Diagnosis: Acute Pancreatitis, Card: 4532-8901-2345-6789"
      }
    ]
  }
}

{
  "jsonrpc": "2.0",
  "id": "query-781",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Found Patient record: [NAME_REDACTED_1], SSN: [SSN_REDACTED_1], DOB: [DATE_YEAR_ONLY_1984], Diagnosis: [PHI_PROTECTED_CONDITION], Card: [PAN_REDACTED_ENDING_6789]"
      }
    ],
    "_meta": {
      "compliance_audit": {
        "status": "SANITIZED",
        "redacted_entities_count": 5,
        "policy_version": "hipaa-v4.2"
      }
    }
  }
}

import crypto from 'crypto';

interface RedactionPattern {
  name: string;
  regex: RegExp;
  mask: (match: string) => string;
}

export class McpComplianceSanitizer {
  private patterns: RedactionPattern[] = [
    // US Social Security Numbers (SSN)
    {
      name: 'US_SSN',
      regex: /\b(?!000|666|9\d{2})\d{3}[- ]?(?!00)\d{2}[- ]?(?!0000)\d{4}\b/g,
      mask: () => '[SSN_REDACTED]'
    },
    // Credit Card Primary Account Numbers (Luhn-compliant regex)
    {
      name: 'PAYMENT_CARD',
      regex: /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b/g,
      mask: (m) => `[CARD_ENDING_${m.slice(-4)}]`
    },
    // Protected Health Information (Medical Record Numbers)
    {
      name: 'EHR_MRN',
      regex: /\bMRN[0-9]{7,10}\b/gi,
      mask: () => '[MRN_REDACTED]'
    },
    // Email Addresses
    {
      name: 'EMAIL',
      regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,7}\b/g,
      mask: () => '[EMAIL_REDACTED]'
    }
  ];

  public sanitizeJsonRpcPayload(payload: any): { sanitized: any; redactedCount: number } {
    let count = 0;
    const jsonString = JSON.stringify(payload);

    let sanitizedString = jsonString;
    for (const pattern of this.patterns) {
      sanitizedString = sanitizedString.replace(pattern.regex, (match) => {
        count++;
        return pattern.mask(match);
      });
    }

    return {
      sanitized: JSON.parse(sanitizedString),
      redactedCount: count
    };
  }
}

graph TD
    Request[JSON-RPC Tool Call Request] --> HashReq[Compute SHA-256 Hash]
    Response[JSON-RPC Tool Call Response] --> HashRes[Compute SHA-256 Hash]
    HashReq & HashRes --> Manifest[Generate Merkle Audit Record]
    Manifest --> WORM[AWS S3 Bucket: Object Lock Compliance Mode 7-Year Retention]

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import crypto from 'crypto';

const s3 = new S3Client({ region: 'us-east-1' });
const AUDIT_BUCKET = process.env.COMPLIANCE_AUDIT_BUCKET || 'enterprise-mcp-audit-vault';

export interface AuditRecord {
  requestId: string | number;
  timestamp: string;
  tenantId: string;
  userEmail: string;
  toolName: string;
  clientIp: string;
  requestPayloadHash: string;
  responsePayloadHash: string;
  redactedEntitiesCount: number;
  previousRecordHash: string;
}

let lastChainHash = '0000000000000000000000000000000000000000000000000000000000000000';

export async function recordImmutableMcpAudit(
  req: any,
  res: any,
  meta: { tenantId: string; userEmail: string; clientIp: string; redactedCount: number }
): Promise<string> {
  const timestamp = new Date().toISOString();
  
  const reqHash = crypto.createHash('sha256').update(JSON.stringify(req)).digest('hex');
  const resHash = crypto.createHash('sha256').update(JSON.stringify(res)).digest('hex');

  const record: AuditRecord = {
    requestId: req.id,
    timestamp,
    tenantId: meta.tenantId,
    userEmail: meta.userEmail,
    toolName: req.params?.name || 'unknown',
    clientIp: meta.clientIp,
    requestPayloadHash: reqHash,
    responsePayloadHash: resHash,
    redactedEntitiesCount: meta.redactedCount,
    previousRecordHash: lastChainHash
  };

  const recordBytes = Buffer.from(JSON.stringify(record, null, 2));
  const recordHash = crypto.createHash('sha256').update(recordBytes).digest('hex');
  lastChainHash = recordHash;

  // Persist to WORM Storage with Object Lock Legal Hold
  const key = `audit/year=${timestamp.slice(0,4)}/month=${timestamp.slice(5,7)}/${record.requestId}-${recordHash}.json`;

  await s3.send(new PutObjectCommand({
    Bucket: AUDIT_BUCKET,
    Key: key,
    Body: recordBytes,
    ContentType: 'application/json',
    ObjectLockMode: 'COMPLIANCE',
    ObjectLockRetainUntilDate: new Date(Date.now() + 7 * 365 * 24 * 60 * 60 * 1000) // 7-year retention
  }));

  return recordHash;
}