# MCP Overview
URL: https://docs.autociso.io/developers/mcp/overview/
Description: Connect AI clients like Claude and Cursor to your AutoCISO compliance data over MCP.

The **Model Context Protocol (MCP)** is an open standard that lets AI clients — like Claude Desktop, Cursor, and VS Code — call tools on your behalf. AutoCISO ships an MCP server so an assistant can read your access, ISO, risk, supplier, and maturity data — the same data, PII-masked, that the console shows — and answer questions like *"What's my access posture?"* without you copying numbers out of the console.

## What AutoCISO exposes

AutoCISO publishes **66 tools** across these areas (each one names its lowest plan in the [Tool Catalog](https://docs.autociso.io/developers/mcp/tools/); see [Plans & Features](https://docs.autociso.io/getting-started/plans-and-features/) for what each plan includes):

- **Access intelligence** — the full [access inventory](https://docs.autociso.io/console/access/inventory/) (every employee × asset grant, paged), stale accounts, privilege concentration, offboarding violations, department risk, zombie accounts, toxic combinations, and more.
- **User access reviews (UAR)** — campaign status and open items.
- **ISO 27001** — gap analysis, Statement of Applicability, control status, roadmap, policies, readiness, evidence, certification bodies and certificate status.
- **Risk** — list and read the risk register, plus a write tool to draft a risk.
- **Suppliers and supply chain** — third parties, assessment status, questionnaire authoring, SBOMs, findings and vendors.
- **Compliance, monitoring and privacy** — posture across frameworks, crosswalks, continuous monitoring, HIPAA readiness, and privacy-operations metadata.
- **Audit and evidence** — the audit trail, the evidence log and automated evidence jobs.
- **Maturity & posture** — latest maturity scores and an overall posture summary.

**Note — Read-only by default**

Of the 66 tools, 61 are read-only and 5 write. Every write tool needs its write scope **and** writes enabled for your deployment; without both it does not appear in `tools/list`. See [MCP Auth and Scopes](https://docs.autociso.io/developers/mcp/authentication/) and the [Tool Catalog](https://docs.autociso.io/developers/mcp/tools/).

## Pick your path

| I want to… | Use | Guide |
|------------|-----|-------|
| Make my first call | A token and cURL | [MCP Quickstart](https://docs.autociso.io/developers/mcp/quickstart/) |
| Chat with my compliance data | Claude Desktop | [Connect Claude Desktop](https://docs.autociso.io/developers/mcp/claude-desktop/) |
| Ask from my editor's AI panel | Cursor or VS Code | [Connect Cursor and VS Code](https://docs.autociso.io/developers/mcp/cursor-vscode/) |
| Build a Node integration | TypeScript SDK | [MCP TypeScript SDK](https://docs.autociso.io/developers/mcp/typescript-sdk/) |
| Build Python scripts and agents | Python SDK | [MCP Python SDK](https://docs.autociso.io/developers/mcp/python-sdk/) |
| Browse every tool | Tool Catalog | [MCP Tool Catalog](https://docs.autociso.io/developers/mcp/tools/) |

Every path authenticates the same way: a bearer token with the **MCP Read** scope (`mcp:read`), plus write scopes only if you need a write tool. See [MCP Auth and Scopes](https://docs.autociso.io/developers/mcp/authentication/); creating the token is covered in [API tokens](https://docs.autociso.io/developers/api-tokens/).

## The raw surface

Every MCP client speaks the same JSON-RPC protocol under the hood. To see the tool list directly:

**cURL**

```bash
curl -s \
  -H "Authorization: Bearer $AUTOCISO_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
  "https://api.autociso.io/mcp"
```

The SDKs and AI clients wrap this for you — you rarely call it by hand. To see what a response looks like, follow the [MCP Quickstart](https://docs.autociso.io/developers/mcp/quickstart/); for what each answer can contain, see [MCP Capabilities](https://docs.autociso.io/developers/mcp/capabilities/).