What crosses the MCP boundary

Connecting a client to Finexia adds a party to the conversation, and the useful question is not “is it secure” but “what does that party get to see”. Below, per link in the chain.

#Everything runs on your machine

• The client launches the server as a subprocess, on your machine. That is what the stdio transport is: no port, no network listener, no address to reach from outside 3.
• The server hands the request to the running application over a local Unix socket — a file on your disk, not a network endpoint.
• The application runs the mandates, drives the vendor CLIs you signed into, and writes into your data room. Nothing about that changes because the request came from a client instead of the window.
• The server writes only protocol messages on standard output and keeps its logs on standard error, as the transport requires. A stray line on the wrong stream breaks a session; a test holds it.

#What reaches the model, and what never does

#Roles and capabilities still decide

A request arriving over MCP does not bypass anything. The mission is routed to mandates, and each mandate reaches only what its declared capabilities cover — the same table that stops the application from opening if a role ever combines reading your data with reaching outward. A client can ask; it cannot widen.

Provenance behaves the same way. A tool that reports a source writes it to the journal with its address, its period, its metric and the date it was read, and any secret embedded in that address is redacted on the way in.

#Local MCP and a remote connector are not the same thing

• CLIENT-VERIFIEDLocal server, launched by your clientProven on 2026-09-10 with Claude Code 2.1.265. The process runs as you, on your machine, and reaches the app over a local socket.
• PLANNEDA remote connector pointed at your machineImpossible by construction rather than unimplemented: a custom connector’s connection starts from the vendor’s servers, not from your network, so a loopback address is not something it can reach 5.
• PLANNEDA hosted Finexia endpointIt would need a public endpoint implementing the current transport — a single POST path, origin validation on every request 4 — plus a delegated sign-in flow. None of it is written, and hosting a desk would reverse the rule the product is built on.