Appearance

Security ​

Access control ​

The MCP server applies the same access-control principles as the rest of the Quarzo Life platform. The information available to an MCP client depends on:

  • the authenticated user;
  • their role;
  • the distributor or organization they belong to;
  • the clients and contracts they are authorized to access;
  • the permissions granted to the MCP client.

A subscriber can only access their own authorized contracts and data. A broker can only access clients and contracts covered by their distribution and servicing permissions.

Authentication ​

The MCP server has no open or anonymous access. Every connection requires the user to be authenticated — there is no anonymous mode and no standalone API-key-only access for end users.

Connecting an MCP client triggers an OAuth authorization flow: the user is redirected to log in with their Quarzo Life account and authorize the client before it can access any tool. Authorization may be further limited according to the client, the user's role, and the requested permissions. See Installation for the full setup procedure.

Security and auditability ​

All MCP requests are subject to Quarzo Life's security requirements, including:

  • authentication and authorization controls;
  • least-privilege access;
  • permission checks for every requested resource;
  • logging and traceability of tool calls;
  • protection of personal and financial data;
  • prevention of sensitive data exposure in technical logs;
  • revocation of client access;
  • session and token expiration controls.

An MCP client cannot access more information than the authenticated user would be allowed to access through the Quarzo Life platform.

Data freshness ​

The MCP server returns the most recent information available in Quarzo Life. For financial values, responses may include:

  • the valuation date;
  • the latest known NAV or market price;
  • the execution date;
  • the settlement date;
  • the current processing status;
  • an indication that a value is provisional or awaiting confirmation.

Some funds or assets may not be valued daily. The MCP client should therefore preserve and display the valuation date when presenting financial information.