FINOS MCP - AI Governance (community)

finos-mcp

Lets AI assistants look things up in three open financial-industry standards, accurately and without being able to change anything.

Start with a question

To connect to an assistant, use the copy-paste client setup guide. To see a real MCP call without a model or API key, clone this repository, run uv sync --all-packages, then try:

uv run --no-sync python examples/try_it.py aigf

Choose either of the other two servers in the tested example recipes. This is independent community software, not an official FINOS product.

What is this?

Banks and other financial firms share a set of open standards published by FINOS, the Fintech Open Source Foundation. Three of them matter here:

• the AI Governance Framework, a catalogue of the risks of using AI in finance and the controls that reduce them;
• the Common Domain Model (CDM), a shared way to describe trades and what happens to them;
• FDC3, the standard that lets desktop finance applications talk to each other.

An AI assistant asked about these standards will often answer from memory and get details wrong: an id that does not exist, a field that is not in the schema. This project gives the assistant the real thing to look up instead. It packages each standard as a small server that speaks the Model Context Protocol (MCP), the open protocol that Claude and other assistants use to call external tools.

With the servers connected, an assistant can answer questions like:

• "Which controls reduce the risk of prompt injection, and what do they map to in the EU AI Act?"
• "Is this trade JSON valid CDM? If not, where exactly is it wrong?"
• "My app has a stock ticker selected. Which FDC3 actions can I offer the user?"

Each answer comes with an identifier or link the reader can check against the standard itself.

The three servers

All three are built on finos-mcp-core, a shared package that holds the safety rules described below. The full list of 29 tools is in docs/tools.md, and docs/demo.md shows a real session, including the CDM server finding three deliberate mistakes in a trade document.

Quick start

You need uv and nothing else. There is no account, API key or database to set up.

First-time setup: Follow the MCP client setup guide for copy-paste, version-pinned configurations for Claude Desktop, Claude Code, VS Code and GitHub Copilot. It also covers Windows and macOS setup, verifying a real tool call, and troubleshooting. The quick-start example below installs the latest version rather than pinning one.

Claude Desktop or Claude Code. Add this to your MCP configuration (full example) and restart:

{
  "mcpServers": {
    "finos-aigf": { "command": "uvx", "args": ["--python", "3.12", "finos-mcp-aigf"] }
  }
}

From the command line.

# talk over stdin/stdout, the way desktop assistants connect
uvx --python 3.12 finos-mcp-aigf

# or serve HTTP on localhost
uvx --python 3.12 finos-mcp-aigf --transport streamable-http --port 8000

As a container. It needs no writable disk and no extra privileges:

docker run --rm -p 8000:8000 --read-only --cap-drop ALL     -e FINOS_MCP_ALLOWED_HOSTS='localhost:*,127.0.0.1:*' ghcr.io/vardhjain/finos-mcp

The allowed-hosts setting makes the server refuse requests that arrive under any other host name, which stops a web page in your browser from reaching the port.

Swap finos-mcp-aigf for finos-mcp-cdm or finos-mcp-fdc3 to run the other servers. examples/ includes a low-memory, reproducible live demo, a short Python client, and a LangGraph agent.

Why it is safe to connect

Giving an assistant new tools is a risk, so the servers are deliberately limited:

• They can only read. No tool writes a file, sends a message or changes any system. The server refuses to serve any tool if one of them is not marked read-only.
• They work offline. The standards are copied into the packages at build time, with the exact upstream version recorded. Nothing is fetched while the server runs.
• They cannot be flooded. Every tool has a rate limit and a cap on input and output size.
• Mistakes are explained. A bad request gets a structured error that says what was wrong and what to try, so the assistant can correct itself instead of guessing.
• Everything is logged. Each call is written to an audit log, with a fingerprint of its arguments in place of the raw content.

The details, including every setting, are in docs/safety.md.

One optional feature does use the network. Installing the semantic extra adds meaning-based search, which downloads a small open model on first use. Without it, search is keyword-based and fully offline.

How well it works

These numbers are measured by automated checks and published to the metrics branch. The badges above read that file directly, so they show measurements from a specific commit.

The offline metrics update on every push to main; the search result in this table is from October 2026. The agent test uses Claude Haiku 4.5 and requires paid Anthropic API credits. To prevent surprise costs, it only runs through an explicit manual opt-in in GitHub Actions, never on a timer or PR label. Its published figures are from the last successful evaluation on 14 September 2026 and are not live data. Deterministic tests and retrieval evaluations continue to run in CI without LLM API calls.

Building this also turned up 15 defects in the upstream standards, recorded in docs/upstream-findings.md. The first was reported to FINOS, and its YAML fix merged upstream in PR #380 on October 21, 2026.

Project layout

Development

uv sync --all-packages --all-extras
uv run pytest
uv run pytest evals/offline/test_workflows.py -v  # 16 multi-tool scenarios, no paid APIs
uv run ruff check . && uv run mypy core/src servers/*/src

See CONTRIBUTING.md for the ground rules, CHANGELOG.md for what changed in each release, RELEASING.md for how releases are made, and PLAN.md for the original design record.

Status

For maintainers, MCP directory and registry readiness records where this project is already indexed, which listing metadata is stale, and the ownership checks required before separately registering the three published server packages. Directory submissions require explicit approval.

The latest published release is available on PyPI as finos-mcp-core, finos-mcp-aigf, finos-mcp-cdm and finos-mcp-fdc3, for Python 3.12 and later, and as a container image for x86 and ARM.

Not affiliated with or endorsed by FINOS. These are independent community packages. Some official FINOS packages on PyPI also start with finos-; nothing here is one of them.

Licenses

The code is Apache-2.0. The copied standards keep their own licenses: the AI Governance Framework is CC-BY-4.0, and CDM and FDC3 are under the Community Specification License 1.0. See NOTICE.