MCP Overview

The Model Context Protocol (MCP) is an open standard that lets AI clients — like Claude Desktop, Cursor, and VS Code — call tools on your behalf. AutoCISO ships an MCP server so an assistant can read your access, ISO, risk, supplier, and maturity data — the same data, PII-masked, that the console shows — and answer questions like “What’s my access posture?” without you copying numbers out of the console.

What AutoCISO exposes

AutoCISO publishes 66 tools across these areas (each one names its lowest plan in the Tool Catalog; see Plans & Features for what each plan includes):

• Access intelligence — the full access inventory (every employee × asset grant, paged), stale accounts, privilege concentration, offboarding violations, department risk, zombie accounts, toxic combinations, and more.
• User access reviews (UAR) — campaign status and open items.
• ISO 27001 — gap analysis, Statement of Applicability, control status, roadmap, policies, readiness, evidence, certification bodies and certificate status.
• Risk — list and read the risk register, plus a write tool to draft a risk.
• Suppliers and supply chain — third parties, assessment status, questionnaire authoring, SBOMs, findings and vendors.
• Compliance, monitoring and privacy — posture across frameworks, crosswalks, continuous monitoring, HIPAA readiness, and privacy-operations metadata.
• Audit and evidence — the audit trail, the evidence log and automated evidence jobs.
• Maturity & posture — latest maturity scores and an overall posture summary.

Pick your path

Every path authenticates the same way: a bearer token with the MCP Read scope (mcp:read), plus write scopes only if you need a write tool. See MCP Auth and Scopes; creating the token is covered in API tokens.

The raw surface

Every MCP client speaks the same JSON-RPC protocol under the hood. To see the tool list directly:

curl -s \
-H "Authorization: Bearer $AUTOCISO_MCP_TOKEN" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
"https://api.autociso.io/mcp"

The SDKs and AI clients wrap this for you — you rarely call it by hand. To see what a response looks like, follow the MCP Quickstart; for what each answer can contain, see MCP Capabilities.