MCP Overview

The Model Context Protocol (MCP) is an open standard that lets AI clients — like Claude Desktop, Cursor, and VS Code — call tools on your behalf. AutoCISO ships an MCP server so an assistant can read your access, ISO, risk, supplier, and maturity data and answer questions like “What’s my access posture?” without you copying numbers out of the console.

What AutoCISO exposes

AutoCISO publishes 23 tools across these areas:

• Access intelligence — stale accounts, privilege concentration, offboarding violations, department risk, and more.
• User access reviews (UAR) — campaign status and open items.
• ISO 27001 — gap analysis, Statement of Applicability, and control status.
• Risk — list and read the risk register, plus one optional write tool to draft a risk.
• Suppliers — list third parties and assessment status.
• Maturity & posture — latest maturity scores and an overall posture summary.

Four ways to connect

All four authenticate the same way: a bearer token with the mcp:read scope (and mcp:write only if you need the draft tool). See MCP Auth and Scopes.

Pick your path

• New here? Start with the MCP Quickstart — get a token and make your first call in five minutes.
• Connecting an app? Jump to Claude Desktop or Cursor / VS Code.
• Building code? Use the TypeScript or Python SDK.
• Need the full surface? Browse the MCP Tool Catalog.

The raw surface

Every MCP client speaks the same JSON-RPC protocol under the hood. To see the tool list directly:

curl -s \
-H "Authorization: Bearer $AUTOCISO_MCP_TOKEN" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
"https://autociso.io/mcp"

The SDKs and AI clients wrap this for you — you rarely call it by hand.