app.scfcontrolsplatform/mcp-server-scf

Link a scoped control to a custom risk (write — editor+ role). The control must already be scoped (in-scope) for this organization.

Grant an existing user read access to one engagement (write — admin role). Scoped to that engagement's frozen scope and queries only; re-granting a revoked auditor reactivates the grant.

Add an organization member to a team as primary, delegate or member (write — admin role). Adding a primary or delegate when the seat is taken demotes the incumbent to member.

Apply a previewed reconciliation run (write — admin role). Asynchronous. The run must be 'previewed' and expected_to_version must match, so a stale preview is refused rather than applied.

Assign one team to up to 500 controls or evidence items in one transaction with one aggregate notification (write — admin role). The bulk accountability tool.

Batch-update up to 500 scoped controls in one transaction (write — editor+ role). Each operation identifies its target by scf_id; status values are lowercase.

Create or update up to 500 evidence tracking records in one transaction (write — editor role). Each upserts by evidence_id; only fields given change. Use instead of 500 scf_update_evidence calls.

Queue AI assessments for multiple evidence files (write — editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued.

Queue windowed AI assessments for up to 25 evidence IDs (write — editor+ role, async). Items without tracking or a frequency set are reported under `skipped_detail` in the response.

Remove from scope every control mapped only to the given frameworks (destructive write — editor role). Controls shared with another in-scope framework are kept; notes and status survive.

Cancel a reconciliation run that has not been applied (write — admin role). The organization stays on its current catalog version.

Mark an evidence collection task completed (write — editor role). Sets status to completed and stamps the completion date; optional completion notes are stored with it.

Assign a user to a control, evidence item or task as primary or collaborator (write — editor role). Use scf_batch_update_evidence for evidence owners in bulk.

Post a comment on a control, evidence item or task (write — any member). Mention users by UUID to notify them; set parent_comment_id to reply in a thread.

Record a compensating control for a vendor gap (write — editor role): what the gap is, what offsets it, and how effective that is (full, partial or minimal — default partial).

Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record.

Create an audit engagement in draft (write — editor role). Freezes the in-scope controls for the named frameworks against the current catalog version, so the scope renders after deprecations.

Raise an auditor query against one control in the engagement's scope (write — org member or assigned auditor). The control must be in the engagement's frozen scope.

Create an evidence tracking record from a catalog evidence ID (write — editor+ role). Starts tracking an evidence item for the organization.

Create a manual evidence collection task against a tracking record (write — editor role). Due date and evidence_tracking_id are required; status defaults to not_started, priority to medium.

Create a new risk assessment in the risk register (write — editor+ role). Likelihood and impact scores populate the 5×5 risk matrix.

Create a system in the organization's infrastructure inventory (write — editor+ role). Systems can be linked to capabilities and evidence.

Declare that a system can provide one evidence type (write — editor role). One entry per evidence_id per system; status defaults to potential, confidence to medium.

Create a team aligned to a business function (write — admin role). The team is born empty; that is legal and reported through health warnings, not refused.

Assign a team to one scoped control or evidence item (write — admin role). is_accountable makes it the accountable team and demotes any incumbent to consulted.

Create a vendor in the TPRM registry (write — editor+ role). Platform auto-scores risk based on criticality and data handling.

Create a remediation action item against a vendor (write — editor role), typically from an assessment finding. Priority defaults to medium, status to open.

Record a certification a vendor holds (write — editor role), e.g. ISO 27001 or SOC 2 Type II. Status defaults to valid; track expiry_date so renewals surface.

Create a webhook endpoint for evidence-inbox ingestion (write — admin role). Returns the plaintext HMAC signing secret exactly once — store it immediately; it cannot be retrieved later.

Remove a user assignment (destructive write — editor role).

Retract a comment you authored (write — author only). Soft delete: the thread keeps its place, the body is withdrawn.

Delete a vendor compensating control record (destructive write — editor role).

Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible.

Delete a draft audit engagement and its frozen scope (destructive write — admin role). Non-draft engagements are refused with 409 — close them instead. Auditor grants are revoked with it.

Soft-delete an evidence file (destructive write — editor role). The record is marked deleted and drops out of listings; the stored object is retained for audit and retention.

Delete an organization's scoring of a risk code (destructive write — editor role). The catalog or custom risk definition itself remains; only this org's assessment row is removed.

Remove a team's assignment from a control or evidence item (destructive write — admin role).

Delete a vendor action item (destructive write — editor role). Prefer status=cancelled when the record should stay visible.

Delete a vendor certification record (destructive write — editor role). Prefer status=expired or revoked when the history matters.

Revoke a webhook endpoint — soft-delete that marks it inactive (destructive write — admin role). Future deliveries return 403; the record remains for audit.

Export a document as rendered markdown or HTML text (read — viewer role). The platform also renders PDF, but that is a binary download and is not offered here — fetch it from the web UI instead.

Queue ISMS document generation for one or more generators (write — admin role). Returns a task_id; poll scf_get_document_generation_status. Existing documents are skipped unless force is set.

Queue AI generation of evidence-collection recipes for a system (write — editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress.

List AI evidence assessments waiting for a human decision, worst first (read — viewer role): most gaps, then most unassessable objectives, then least relevant, then oldest.

Query one organization's append-only audit trail (read — viewer role): field-level changes with actor, source and before/after values. Filter by entity, control, action, actor, source, date or text.

Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage.

Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards.

Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands.

Get this organization's catalog changelog (read — viewer role): what changed across reconciliations, newest first. Answers 'when did this control change, and what did we decide?'

Get one catalog evidence entry with the controls it maps to (read, no org). The reference definition, not an organization's tracking record — see scf_get_evidence for that.