MCP Server Transfer Pricing: What an MCP Server Is and Why a Platform Offers One

MCP Server Transfer Pricing: What an MCP Server Is and Why a Platform Offers One

An MCP server in transfer pricing software is a defined set of functions that lets an AI assistant query a platform under a signed-in user's permissions, using the open Model Context Protocol. MCP server transfer pricing safety depends on role-based access, retention terms and human sign-off. The protocol authenticates the caller but does not apply a firm's roles.

Key takeaways

• Model Context Protocol is an open standard created by Anthropic and, since 9 December 2025, hosted by the Agentic AI Foundation under the Linux Foundation.
• MCP servers offer tools (model-controlled), resources (application-driven) and prompts (user-controlled).
• MCP authorization is optional and OAuth 2.1 based, but role rules and sign-off logic stay with the platform, not the protocol.
• TP DOC GEN AI states its TAIGA MCP server lists 74 tools, refuses tools with no role list and keeps no session between requests, as at 21 October 2026.
• A stateless server does not control what an AI assistant provider does with an answer, so confidentiality duties still apply.
• Enabling an AI connection is a documented firm-level decision, tested in a short pilot with refusals and write attempts recorded.

On this page

• MCP server transfer pricing: what the term means in practice
• How MCP works: tools, resources and prompts
• How MCP authorization and permissions work
• What TAIGA's MCP server offers, as stated by TP DOC GEN AI
• What stays governed when an AI assistant is asking
• How confidentiality duties apply to AI assistant transfer pricing engagement data
• MCP security risks and the standards that map to them
• Why enabling MCP is a firm decision, and what to ask a vendor
• A 30-day pilot plan and what changes by firm size
• Frequently asked questions

MCP server transfer pricing: what the term means in practice

Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems such as databases, files and business software, as the MCP introduction explains. In an MCP server transfer pricing setup, the transfer pricing platform runs the MCP server and publishes a limited list of functions. An AI assistant acts as the client and can call those functions only after the user signs in.

Before MCP, linking an assistant to a specific application usually meant a custom integration for that one pairing. MCP gives both sides a common way to discover what a system offers and to call it. A useful comparison is a standard port: the assistant and the platform no longer need to be built for each other.

Who created and maintains MCP

Anthropic created MCP and introduced it as an open standard. On 9 December 2025 Anthropic announced the donation of MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation. The announcement names Anthropic, Block and OpenAI as co-founders and says the project's governance model remains unchanged.

The protocol is defined in the MCP specification, which uses JSON-RPC 2.0 messages between hosts, clients and servers. As at 21 October 2026 the current specification carries the version label 2026-07-28. Record the version your vendor supports, because the protocol is still evolving.

What a practice would use it for

A partner might ask an assistant which current engagements have a filing deadline in the next two weeks. Another request could be a first-pass status email for one client, based on the engagement's stage in the workflow. Without a connection, the partner opens the platform, checks the calendar and pastes details into a separate AI tool by hand.

With a connected transfer pricing platform, the assistant queries the platform directly and sees only what the partner's own role allows. That is the practical promise of Model Context Protocol transfer pricing software. The rest of this guide covers how far that promise holds and what a firm should verify.

How MCP works: tools, resources and prompts

The specification names three roles. Hosts are the AI applications that start connections, clients are connectors inside the host, and servers provide context and capabilities. A server can offer three features, and each one has a different controller.

Tools are model-controlled, so the specification says there should always be a human in the loop with the ability to deny tool invocations. Servers must validate tool inputs, implement access controls, rate limit calls and sanitise outputs. Clients should show inputs before a call and log tool usage for audit.

Resources are application-driven, and the specification says access controls should be implemented for sensitive resources and permissions checked before operations. Prompts are user-controlled and must have their inputs and outputs validated to prevent injection or unauthorised access.

One detail matters for permissions. The list of tools a server returns may vary with the authorization presented on the request, for example only the tools the caller's granted scopes permit. That is the protocol-level hook a platform can use to show different tools to a practitioner, a manager and a taxpayer.

How MCP authorization and permissions work

Authorization in MCP is optional, and the authorization specification applies to HTTP-based transports. When a server supports it, the server acts as an OAuth 2.1 resource server and the client acts as an OAuth 2.1 client. A separate authorization server signs the user in and issues access tokens.

The flow in six steps

1. The client calls the server without a token, and the server answers HTTP 401 with a header that points to its protected resource metadata, which servers must implement under RFC 9728.
2. The client reads that metadata to find the authorization server and its endpoints.
3. The client identifies itself using a client ID metadata document, pre-registration or dynamic registration, which the specification now marks as deprecated.
4. The client sends the user to the authorization server with PKCE and a resource parameter that names the MCP server, and the user signs in and approves.
5. The client sends the access token in the Authorization header on every request, never in the query string.
6. The server validates that the token was issued for it. An invalid or expired token gets a 401, and insufficient scope gets a 403.

Two rules matter most for a practice. A server must accept only tokens issued for it, and token passthrough is explicitly forbidden, as the MCP security best practices explain. Scopes should follow least privilege, with a small initial set and step-up requests for sensitive operations.

The specification also sets a consent principle. Hosts must obtain explicit user consent before exposing user data to servers and before invoking any tool. For a firm, that consent is the user's click, and the firm's policy decides whether the user may click at all.

What TAIGA's MCP server offers, as stated by TP DOC GEN AI

TAIGA, the platform from TP DOC GEN AI, lists an MCP server in its product navigation. According to the TAIGA MCP server page, a user connects Claude Desktop or another MCP client and asks about engagements or benchmarking studies in plain language. The page states that answers come from the same services the web app uses, under the user's sign-in and role.

As at 21 October 2026 the page lists 74 active tools in 13 areas, 10 resources and 8 guided prompts. It states that the server publishes OAuth 2.1 protected-resource metadata under RFC 9728 with the scopes mcp:tools, mcp:resources and mcp:prompts. A missing or bad token returns an 'Authorization required' response.

On permissions, the page says a tool with no role list is refused by default and that firm admins can call every tool. A refusal names the roles required, with the page's own example reading: Role client_user cannot access tool 'override_comparable'. Required: tpo_user | tpo_reviewer.

On data, the page states that the MCP server holds no data and keeps no session between requests, and that each request becomes a call to the same endpoints the web app calls. It also says calculations are deterministic and not produced by a language model, which matches the design described in the post on AI document reading and deterministic math.

Not every listed capability is live. The page says Local File generation is not available through the server yet, so reports are generated in the app. It also lists a compliance check among the tools while stating that compliance checks are not available there yet, so ask which tools are active for your firm.

What stays governed when an AI assistant is asking

The TAIGA team workflow page describes three nested seats. A practitioner prepares the file and submits it for review but cannot assign or approve work. A manager does everything a practitioner can and also assigns, approves or returns work, and an admin additionally manages firm staff.

The TAIGA page says these permissions are checked by the API, not only hidden on screen.

Submitted work goes to the manager or admin with the fewest open reviews, never to its author. The page states that the API refuses an approval from the person who submitted the work, whatever their seat. Returning work needs a written note, approval locks the engagement, and who submitted and who decided stay on the record.

If the MCP server calls the same endpoints as the web app, as its page says, those checks should apply to an assistant's request too. That is the vendor's statement, and a firm should test it in a trial rather than assume it. The post on practice management roles and oversight explains why role design comes first.

One query, step by step (illustrative)

1. A practice manager asks the assistant: which of my engagements have a deadline in the next 14 days?
2. The host asks the manager to approve the tool call, then the client calls a tool such as list_upcoming_deadlines with the manager's token.
3. The server verifies the token before any tool runs and checks the manager's role against the tool's role list.
4. The server calls the same service the web app uses, scoped to the manager's firm, and returns structured results.
5. The assistant writes a plain-language answer and, if asked, drafts a status email from it.
6. The server keeps no session, but the answer now sits in the assistant's own history under the assistant provider's terms.

Deadlines in that answer depend on how the calendar computes them. The TP Calendar page says due dates are computed from a timing rule and the fiscal year-end, and that request-triggered items such as a UAE Local File get no guessed date. For the wider calendar logic see the guide to the TP Calendar for India and UAE deadlines.

How confidentiality duties apply to AI assistant transfer pricing engagement data

Transfer pricing engagement data is unusually sensitive. It typically includes unpublished intercompany prices, margins, benchmarking sets, draft positions and group structure that a client disclosed for one purpose. Any AI assistant transfer pricing engagement data request touches that material, so the duties below apply to it as they apply to email or shared drives.

Several layers of duty usually apply, and the exact mix depends on the client and the country. This is general information, not legal advice, so confirm obligations with your own counsel. The OECD transfer pricing hub and the OECD Transfer Pricing Guidelines set the documentation context, but they do not replace local confidentiality rules.

• Contract: the engagement letter and any non-disclosure agreement set what the practice may do with client information and who may see it.
• Professional ethics: the code that binds the practice's chartered accountants or other advisers normally includes a duty of confidentiality.
• Data protection law: where information relates to identifiable people, applicable data protection rules may add duties on processing, transfer and vendors.
• Tax authority exchange: documentation such as a Local File is prepared for authorities, as the OECD's own Action 13 report sets out, but working papers and unpublished prices go only where the client and the law require.

An AI connection does not change those duties, but it adds a new recipient: the assistant provider. Treat that provider like any other service provider handling client information. Check that engagement terms allow it, or obtain client consent where the terms require it.

Practical steps for the practice

• Separate data categories: portfolio status and deadlines carry less risk than benchmarking results or draft pricing positions.
• Check where the assistant provider processes data, and ask counsel which cross-border rules apply to your clients.
• Update privacy notices and engagement terms if AI assistants will touch client files.
• Log who enabled each connection, when, and under whose approval.

For a second view on client-data governance in a tax practice, the SBC India transfer pricing team and the SBC UAE transfer pricing service are available to discuss engagement terms.

MCP security risks and the standards that map to them

The OWASP MCP Top 10 lists ten risks for MCP deployments, including token mismanagement, privilege escalation through scope creep, tool poisoning, insufficient authentication and authorization, lack of audit and telemetry, shadow MCP servers, and context over-sharing. As at 21 October 2026 the project is marked beta and incubator, so treat it as guidance rather than a settled standard. OWASP's Gen AI Security Project also published A Practical Guide for Secure MCP Server Development on 16 February 2026.

The OWASP Top 10 for LLM Applications 2025 adds two entries that matter here: LLM02 Sensitive Information Disclosure and LLM06 Excessive Agency. Excessive agency means a system has more autonomy, permissions or capabilities than it needs.

Two management frameworks help structure the policy. The NIST AI Risk Management Framework is voluntary, was released on 26 January 2023, and groups work under Govern, Map, Measure and Manage. NIST's Generative AI Profile, NIST-AI-600-1, followed on 26 July 2024, and NIST notes that the framework is being revised.

ISO/IEC 27001:2022 specifies requirements for an information security management system and applies to organisations of any size. The public TP DOC GEN AI pages reviewed for this article do not state an ISO/IEC 27001 certificate, so a firm that needs one should ask for the certificate and its scope. The vendor's Trust Centre is the place to start.

Why enabling MCP is a firm decision, and what to ask a vendor

Because an MCP connection touches confidentiality duties the whole firm owes, enabling it should not be left to individual preference. Firms already govern browser extensions and personal cloud storage on work devices, and AI connections deserve the same default of caution until a tool has been vetted. A partner should not switch one on because it happens to be convenient that week.

What a firm-level position should cover

1. Which roles may enable AI connections at all, and who approves each request.
2. Which data categories a connection may surface, and which are excluded.
3. Which assistants and servers are approved, and how unapproved ones are blocked.
4. How the firm re-checks the connection on a schedule as the assistant or the protocol changes.
5. Where the decision is documented, next to the firm's other data-governance policies.

The vendor's answers matter as much as the firm's policy. The post on how to evaluate transfer pricing AI software gives a longer buyer process, and the three questions below are a minimum for any MCP-style connection.

Common gaps and fixes

• No clear answer on role-based access: ask for the role-to-tool mapping and test it with a low-privilege login.
• A security claim with no retention detail: request written terms covering logging, caching and model training.
• Write access that skips reviewer sign-off: confirm in a trial that an author cannot approve their own file, as the post on AI transfer pricing documentation and human review describes.
• No firm policy on who may enable connections: draft one before the pilot starts.

A 30-day pilot plan and what changes by firm size

A short pilot keeps the decision evidence-based. The SBC UAE SaaS page and the SBC India transfer pricing services describe how SBC supports practices, and a similar structure works for an internal trial.

• Week 1: write the firm position, choose two pilot users in different roles and list the data categories allowed.
• Week 2: connect a test client or sample data and run the same questions as a practitioner, a manager and a taxpayer role, recording each refusal.
• Week 3: attempt a write action as an author and confirm the sign-off rules still stop it, then review the provider's retention terms.
• Week 4: review logs, decide whether to extend, and record the decision and its approver.

In a small practice the pilot can sit with one partner and one reviewer, and the policy can be two pages. Larger firms need a named owner, a register of approved servers and a review of every new assistant release. Either way, the test is the same: does the assistant stay inside the permission structure, or does it create an exception to it?

Related controls are covered in the posts on a firm-wide precedent bank and calculation control tests. You can also see the TP DOC GEN AI platform directly, and the TP DOC GEN AI blog lists further guides.

Glossary

• OAuth 2.1: the authorization framework the MCP specification builds on for HTTP transports.
• Protected resource metadata: a document (RFC 9728) where a server publishes which authorization server issues its tokens.
• Scope: a named permission carried in a token, such as mcp:tools.
• Token passthrough: accepting a token not issued for the server, which the specification forbids.
• Zero data retention: a vendor statement that a model provider does not store prompt content, which should be read with the scope it is given.

Frequently asked questions

What is an MCP server in simple terms?

An MCP server is the part of a software platform that publishes specific functions to AI assistants through the Model Context Protocol. The assistant discovers those functions, calls them with the user's sign-in, and receives structured answers, instead of the firm building a custom integration for each assistant.

Who created and maintains the Model Context Protocol?

Anthropic created MCP. On 9 December 2025 it donated the protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. Anthropic said the governance model stays unchanged, and the specification is published at modelcontextprotocol.io.

Does MCP have built-in permissions?

Partly. MCP defines an optional OAuth 2.1 based authorization flow for HTTP transports, with tokens, scopes and audience checks. It cannot enforce a firm's own role rules, so the server operator must apply role-based access, firm boundaries and approval logic on every request.

What is the difference between MCP tools, resources and prompts?

Tools are functions the AI model can call, resources are data the host application supplies as context, and prompts are templated workflows the user selects. Each has a different controller, so risk and consent controls differ: tool calls need the strictest human-in-the-loop checks.

Does TAIGA have an MCP server and what can it do?

Yes, TP DOC GEN AI lists an MCP server for TAIGA. Its product page states 74 tools across 13 areas, 10 resources and 8 prompts, including engagement, benchmarking and TP calendar tools. Local File generation was stated as unavailable through the server as at 21 October 2026.

Is client data kept by the AI assistant provider after an MCP query?

It can be. TAIGA states its MCP server holds no data and keeps no session, but the answer returned sits in the assistant's own history. Retention there follows the assistant provider's terms, so check those terms and your client agreements before enabling a connection.

Can an AI assistant approve or file a transfer pricing document through MCP?

It should not without the normal human sign-off. TAIGA's team workflow page says its API refuses approval from the person who submitted the work. A firm should still test that an assistant-initiated action cannot bypass the second reviewer before it enables write-capable tools.

Sources

• Model Context Protocol, What is MCP (introduction) - https://modelcontextprotocol.io/docs/getting-started/intro
• Model Context Protocol, Specification (latest) - https://modelcontextprotocol.io/specification/latest
• Model Context Protocol, Authorization specification - https://modelcontextprotocol.io/specification/latest/basic/authorization
• Model Context Protocol, Server tools specification - https://modelcontextprotocol.io/specification/latest/server/tools
• Model Context Protocol, Server resources specification - https://modelcontextprotocol.io/specification/latest/server/resources
• Model Context Protocol, Server prompts specification - https://modelcontextprotocol.io/specification/latest/server/prompts
• Model Context Protocol, Security best practices - https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices
• Anthropic, Donating the Model Context Protocol and establishing the Agentic AI Foundation - https://anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation
• NIST, AI Risk Management Framework - https://www.nist.gov/itl/ai-risk-management-framework
• ISO, ISO/IEC 27001:2022 Information security management systems - https://www.iso.org/standard/27001
• OWASP, MCP Top 10 - https://owasp.org/www-project-mcp-top-10/
• OWASP Gen AI Security Project, A Practical Guide for Secure MCP Server Development - https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development/
• OWASP Gen AI Security Project, Top 10 for LLM Applications 2025 - https://genai.owasp.org/llm-top-10/
• OECD, Transfer Pricing Guidelines for Multinational Enterprises and Tax Administrations 2022 - https://www.oecd.org/en/publications/oecd-transfer-pricing-guidelines-for-multinational-enterprises-and-tax-administrations-2022_0e655865-en.html
• OECD, Action 13 Transfer Pricing Documentation and Country-by-Country Reporting - https://www.oecd.org/en/publications/transfer-pricing-documentation-and-country-by-country-reporting-action-13-2015-final-report_9789264241480-en.html
• TP DOC GEN AI, TAIGA MCP server product page - https://www.tpdocgenai.com/product/mcp-server
• TP DOC GEN AI, Team workflow and roles - https://www.tpdocgenai.com/product/team-workflow
• TP DOC GEN AI, TP Calendar - https://www.tpdocgenai.com/product/tp-calendar

Check the MCP connection against your own role structure

Review the TAIGA MCP server page, then test a low-privilege login and a write attempt in a trial before enabling any AI connection for your firm. See the TAIGA MCP server page