app.scfcontrolsplatform/mcp-server-scf

Link a scoped control to a custom risk (write — editor+ role). The control must already be scoped (in-scope) for this organization.

Grant an existing user read access to one engagement (write — admin role). The grant is engagement-scoped: it exposes that engagement's frozen scope and queries, nothing else in the organization.

Apply a previewed reconciliation run (write — admin role). Asynchronous. The run must be 'previewed' and expected_to_version must match, so a stale preview is refused rather than applied.

Batch-update up to 500 scoped controls in one transaction (write — editor+ role). Each operation identifies its target by scf_id; status values are lowercase.

Queue AI assessments for multiple evidence files (write — editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued.

Queue windowed AI assessments for up to 25 evidence IDs (write — editor+ role, async). Items without tracking or a frequency set are reported under `skipped_detail` in the response.

Cancel a reconciliation run that has not been applied (write — admin role). The organization stays on its current catalog version.

Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record.

Create an audit engagement (write — admin role). This freezes the in-scope controls for the named frameworks against the current catalog version, so the scope renders even after deprecations.

Raise an auditor query against one control in the engagement's scope (write — editor role, or an assigned auditor). The control must be in the engagement's frozen scope.

Create an evidence tracking record from a catalog evidence ID (write — editor+ role). Starts tracking an evidence item for the organization.

Create a new risk assessment in the risk register (write — editor+ role). Likelihood and impact scores populate the 5×5 risk matrix.

Create a system in the organization's infrastructure inventory (write — editor+ role). Systems can be linked to capabilities and evidence.

Create a vendor in the TPRM registry (write — editor+ role). Platform auto-scores risk based on criticality and data handling.

Create a webhook endpoint for evidence-inbox ingestion (write — admin role). Returns the plaintext HMAC signing secret exactly once — store it immediately; it cannot be retrieved later.

Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible.

Delete an audit engagement and its frozen scope (destructive write — admin role). Returns no content on success. Auditor access granted through this engagement is revoked with it.

Revoke a webhook endpoint — soft-delete that marks it inactive (destructive write — admin role). Future deliveries return 403; the record remains for audit.

Export a document as rendered markdown or HTML text (read — viewer role). The platform also renders PDF, but that is a binary download and is not offered here — fetch it from the web UI instead.

Queue ISMS document generation for one or more generators (write — admin role). Returns a task_id; poll scf_get_document_generation_status. Existing documents are skipped unless force is set.

Queue AI generation of evidence-collection recipes for a system (write — editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress.

Get one organization's audit trail: field-level changes to controls, evidence, and related entities, with actor, timestamp, and before/after values.

Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage.

Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards.

Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands.

Get this organization's catalog changelog (read — viewer role): what changed across reconciliations, newest first. Answers 'when did this control change, and what did we decide?'

Get this organization's catalog position (read — viewer role): its catalog version, the platform's current version, and whether reconciliation is due or in flight. Start here.

Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog.

Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async).

Get the authenticated caller's profile: name, email, organization memberships, and per-org role.

Get one generated document in full (read — viewer role): metadata plus every section with its merge state — clean, edited, conflicted or pending retirement. Use this to read a document.

Poll this organization's in-flight document generation (read — viewer role). Returns {status: 'idle'} when nothing is running. Call after scf_generate_documents until it completes.

Get a document's version and transition history (read — viewer role): who moved it between lifecycle states, when, why, and what each generation version changed.

Get the generator's own version of a section, ignoring any human edit (read — viewer role). Use it to see what the platform would produce before resolving a conflict.

Get the organization's document-generation settings (read — viewer role): whether doc-gen is enabled, whether derivative generators are enabled, and the SCF licence acknowledgement state.

Get one audit engagement's detail (read — viewer role, or an auditor assigned to this engagement).

Get the engagement's scope presented natively in one of its frameworks (read — viewer, or assigned auditor): SCF controls organised by that framework's own structure, as an auditor reads them.

Get one auditor query with its full response thread (read — viewer role, or an assigned auditor).

Get an engagement's frozen control scope (read — viewer role, or an assigned auditor). Rows carry a catalog lifecycle badge, so controls deprecated since the freeze still render, marked.

Get the AI assessment for an evidence file: status, relevance score (0–100), structured findings, summary, and audit metadata (model, tokens, cost). Poll after scf_trigger_evidence_assessment.

Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents.

Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact.

Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary.

Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state.

Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities.

Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance.

Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions — the same guidance shown in the platform UI.

Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp.

Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate.

Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet.