MCP server
A read-only Model Context Protocol server lets your own AI assistant, ChatGPT, or an editor that supports the protocol, query your organization's compliance data in natural language. Nothing exists until an owner or admin creates a connection.
Turning it on
From Settings, MCP, an owner or admin generates a connection. The plaintext key is shown once, at creation, and only a prefix is shown afterward. An organization has exactly one connection: generating again rotates the existing one in place rather than creating a second, so past query history stays attached to the same connection record.
Connecting a client
Point an MCP-compatible client at https://app.verazo.eu/api/mcp with an Authorization: Bearer <connection key> header. Every request authenticates and checks a rate limit of 100 requests per minute before any protocol handling occurs. A revoked or unrecognized key and a missing header return the same generic error, so a caller cannot learn which case applied.
The 7 tools
Every tool is read-only. None can create, update, or delete anything. Every call is scoped to the organization that owns the connection key, never a value the caller supplies, and every call is logged with the tool name, a summary of the parameters used, and the number of results returned.
| Tool | Returns |
|---|---|
list_control_checks | Your configured control checks: target, schedule, satisfied framework controls, and each check's most recent evidence status. |
list_evidence_records | Recent evidence records, most recent first, with status, timestamp, and a plain-language summary. Filterable by check and status. |
list_risks | The ISO 27001 clause 6.1 risk register: likelihood, impact, resulting score and severity band, treatment, and status. |
list_vendors | The vendor register: data access and sensitivity, human-set risk rating, the deterministic auto-risk score, subprocessors, and DPA dates. |
list_incidents | The incident register: severity, status, detected/contained/resolved dates, root cause, and remediation. |
list_policies | Policy documents: type, title, status, version, and who approved each one and when. |
get_framework_coverage | How much of a framework's control catalog is covered by your configured checks, and the full list of uncovered controls. |