Developer docs

An API token reaches two surfaces: the supply-chain REST endpoints, and the MCP server. Everything else answers 403 by design.

REST API

Token-authenticated HTTP endpoints for pipelines and internal tools.

• Obtaining an API Token Create, scope, and manage AutoCISO API tokens for service accounts and AI clients.
• API Quickstart Make your first AutoCISO API call in cURL, TypeScript, Go, or Java.
• What an API Token Can Reach AutoCISO API tokens are deny-by-default — the complete allowlist of endpoints they can call, and what happens elsewhere.
• API Scopes The four AutoCISO token scopes, what each grants, and the endpoint-by-endpoint scope matrix.
• Supply Chain API Reference All 13 AutoCISO supply-chain REST endpoints — method, path, scope, parameters, and request bodies.
• Upload an SBOM via API How to upload a Software Bill of Materials (SBOM) to AutoCISO using the public REST API.

MCP

Connect Claude, Cursor, or your own client to your compliance data.

• MCP Overview Connect AI clients like Claude and Cursor to your AutoCISO compliance data over MCP.
• MCP Capabilities What you can actually ask AutoCISO over MCP — seven capability groups covering all 23 tools.
• MCP Quickstart Get a token and make your first AutoCISO MCP call in under five minutes.
• Connect Claude Desktop Add AutoCISO as a remote MCP server in Claude Desktop and verify it works.
• Connect Cursor and VS Code Add AutoCISO as an MCP server in Cursor or VS Code with safe token handling.
• MCP TypeScript SDK Install @autociso/mcp-client and make your first typed MCP tool call from Node.
• MCP Python SDK Install autociso-mcp-client and make your first typed MCP tool call from Python.
• MCP Tool Catalog All 23 AutoCISO MCP tools — arguments, result shape, required scope, and PII masking.
• MCP Auth and Scopes Create MCP tokens, understand mcp:read and mcp:write scopes, and how org binding works.
• MCP Errors and Retries Map MCP error codes to SDK exceptions and understand retry and rate-limit behavior.
• MCP Troubleshooting Symptom, cause, and fix for the most common AutoCISO MCP connection problems.

Reference

Architecture and diagram conventions behind the platform.

• Authentication Authentication API group.
• Create API Token Create an API token for server-to-server use.
• SBOMs SBOMs API group.
• Upload SBOM Upload a CycloneDX or SPDX SBOM to AutoCISO.
• Mermaid Diagrams Author architecture and flow diagrams in developer docs with Mermaid.
• Platform Architecture High-level architecture and data-flow diagrams for the AutoCISO platform.