MCP profiles record tools, resources, prompts, and permissions. RAG profiles record retrieval sources, vector stores, and grounding risk. Privacy profiles record data classes and leakage tests. These are assurance centers on the same register — not a second inventory.
Outcomes
- MCP tool catalogs as first-class assets
- RAG grounding and retrieval risk in one place
- Privacy tests that stay NOT_ASSESSED until run
