MCP Quickstart

This guide gets you from zero to your first AutoCISO MCP call. We’ll fetch your posture summary — a single call that returns data even for a fresh org.

Step 1 — Get a token

1. Go to Settings → API Tokens.
2. Click New token.
3. Give it a name (e.g., mcp-claude-desktop).
4. Select the mcp:read scope.
5. Click Create and copy the token immediately — it’s only shown once.

The MCP Auth and Scopes page covers scopes and org binding in depth. Set the token as an environment variable so you never hard-code it:

export AUTOCISO_MCP_TOKEN="aci_REPLACE_ME"

Step 2 — Make your first call

The MCP endpoint is https://autociso.io/mcp. Authenticate with a bearer token. Here is the same posture_summary call three ways:

curl -s \
-H "Authorization: Bearer $AUTOCISO_MCP_TOKEN" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"posture_summary","arguments":{}}}' \
"https://autociso.io/mcp"

import { AutocisoMcpClient } from '@autociso/mcp-client';

const client = new AutocisoMcpClient({
baseUrl: 'https://autociso.io/mcp',
token:   process.env.AUTOCISO_MCP_TOKEN!,
});

const posture = await client.posture.summary();
console.log(posture);

import os
from autociso_mcp import AutocisoMcpClient

client = AutocisoMcpClient(
  base_url="https://autociso.io/mcp",
  token=os.environ["AUTOCISO_MCP_TOKEN"],
)

posture = client.posture.summary()
print(posture)

A successful response looks like

Results are PII-masked — emails appear as a***@domain.com and personal names are redacted:

{
  "overallScore": 72,
  "staleAccounts": 14,
  "openRisks": 6,
  "isoGapsOpen": 23,
  "topConcern": "14 stale accounts pending review",
  "generatedAt": "2026-06-20T09:00:00Z"
}

Next steps

• Connect Claude Desktop
• Connect Cursor and VS Code
• MCP TypeScript SDK · MCP Python SDK
• Browse all 23 tools