Overview

The Platform MCP Server is a service that securely connects a tenant's AI applications with the Intelligent Risk Platform and developer resources.

The Platform MCP Server transforms Platform API specifications, documentation, and code samples into a single, queryable knowledge graph that enables Intelligent Risk Platform tenants to discover and implement catastrophe modeling and reinsurance workflows.

The Platform MCP Server is available to every Intelligent Risk Platform tenant. All that you need to do is assign a principal (API key or user account) to a user group that has been assigned the IRP Agentic Tools User role. The API key or bearer token is specified in the MCP client configuration and passed to the Platform MCP Server to initiate each session.

Security

All tenant data remains on the Intelligent Risk Platform. Data is not duplicated, copied, or moved to an AI environment outside the Intelligent Risk Platform.

Tenants can control access to the Platform MCP Server and restrict the actions that may be performed by AI agents by means of security credentials. Platform MCP clients must pass security credentials whenever they connect to the Platform MCP Server or perform API operations using Platform APIs. Security credentials enable the Intelligent Risk Platform to authenticate the identity of the client application and confirm that the client application is authorized to access and leverage the requested resources.

The MCP client must pass valid security credentials whenever it connects to the Platform MCP Server and whenever it makes a request that leverages Platform APIs to access Intelligent Risk Platform resources. Connection credentials and execution credentials API operations using MCP Server tools must be authorized separately.

Every Platform MCP Server client must be assigned the appropriate security credentials (e.g. an API key) that has been assigned the appropriate role-based permissions. These credentials are passed in the form of an API key that is assigned to the client or as a bearer token that is associated with an Intelligent Risk Platform user account. To learn more about Intelligent Risk Platform™ security, see Authentication and Authorization.

Connection Credentials

Connection credentials enable the MCP client to connect to the Platform MCP Server.

These credentials are specified in the MCP client configuration and passed to the Platform MCP Server whenever it initiates a new session.

Connection credentials enable the client to connect to the Platform MCP Server and use all discovery tools (e.g. search-api-spec, graph-*, get-operation-spec, vector-search, workflows, docs).

Connection credentials to not enable the client to perform actions using Platform API operations. API operations require that the client pass an execution credential in each session in the form of an IRP_AUTH session variable.

Execution Credentials

Execution credentials enable the MCP client to use API execution tools to perform read and write actions using Platform API operations.

These execution credentials are managed and tracked as IRP_AUTH session variables. These variables can be set in the chat session using the session-variable tool. The IRP_AUTH session variable must be passed to use the execute-api tool.

In Chat-based MCP clients, an execution credential must be specified in each session. The execution credential must be specified separately from the connection credential. MCP clients cannot read credentials from the client configuration file.

The IRP_AUTH is not required to access the Platform MCP Server or to view information about the Intelligent Risk Platform and Platform APIs. An AI agent can use all discovery tools (e.g. search-api-spec, graph-*, get-operation-spec, vector-search, workflows, docs) without passing the IRP_AUTH session variable.

The IRP_AUTH session variable identifies same credential (e.g. API key) that specified in configuration. This session variable must be passed within the chat session in order for the AI agent to perform API operations using the execute-api tool. The MCP client cannot read the client authentication credential from the connection configuration and pass in the session.

Until the IRP_AUTH session variable is set, any request to perform API operation using the execute-api will fail and return the following error:

Auth token not configured. Set it via the set-variable MCP tool (IRP_AUTH) or the IRP_AUTH environment variable.

📷

Credential Security

Many organizations prohibit their developers to enter security credentials such as API keys in AI conversations.

Security credentials entered into a chat window become part of that conversation's record. The security credential is stored by the AI application, synced wherever your conversations sync, and visible to the AI model.

Check your policy first, and prefer the key-safe options.

Platform MCP Server Role-Based Access Controls

The Platform MCP Server leverages the Intelligent Risk Portal data access and security model.

AI tools have read or write access to tenant resources based on assigned entitlement and role-based access controls. Every request to the Platform MCP Server must pass valid credentials (API key or bearer token) and be authenticated at Moody's API gateway. The API key or bearer token represents a principal that has been assigned the appropriate access rights and privileges.

Every principal that has access to the Platform MCP Server must belong to a user group that has been assigned the IRP Agentic Tools User role.

The IRP Agentic Tools User role grants the principal permission to perform two actions:

The IRP Agentic Tools User role does not grant the principal permission to perform any read or write actions. To perform specific actions, the principal must be assigned the appropriate role. For example, a principal assigned the IRP Agentic Tools User role cannot model exposures unless it is also assigned a role with that permission, e.g. the Cat Modeler role. To learn more about Intelligent Risk Platform™ access controls, see Access Controls.