This MCP server preserves a Bearer principal on every tool call and SSE frame, rotates vaulted credentials in place, and enforces per-tool allowlists for agents.
Enables MCP clients to enforce CHP Profile B spend gates, issue and verify signed tool-approval receipts, and audit denied or authorized finance actions.