Question 1

What is the VulnTrek MCP server?

Accepted Answer

It is a hosted Model Context Protocol server that exposes VulnTrek's exposure decisions as tools an AI client can call. A developer or security analyst connects their AI tool to VulnTrek once by OAuth, and from that point can ask about findings, CVEs, dependency impact, remediation campaigns and deployment-gate verdicts in natural language — answered from live platform state, scoped to their own organization.

Question 2

How is this different from a chatbot bolted onto a dashboard?

Accepted Answer

A dashboard assistant answers inside the vendor's own UI, which still requires the developer to go there. MCP inverts that: VulnTrek becomes a capability inside the tools engineers already use. And the tools return computed decisions — VRI scores, exploit evidence, reachability, ownership, SLA state, gate verdicts — rather than a language model's summary of a documentation page.

Question 3

Which AI clients can connect?

Accepted Answer

Any MCP-capable client that supports remote servers with OAuth, including Claude, MCP-aware IDE assistants and agent frameworks. Because the protocol is open and the server is remote and hosted, adding a new client is a connection step, not an integration project.

Question 4

Can the AI tool change data or take action in VulnTrek?

Accepted Answer

Only two narrow things, neither of which changes remediation state. Ten of the thirteen tools are read-only, and the security gatekeeper merely records a verdict in an append-only ledger. submit_findings can add normalized scanner findings to your own organization's scan intake — nothing else; promotion into the vulnerability register is opt-in, and the database enforces the batch cap and per-organization rate limit regardless of what the client asks for. request_action requires the remediation-agent operate permission and creates a pending proposal in your approval inbox that a person with remediation approval rights decides; it performs nothing itself. Neither tool can resolve, reprioritize, dispatch, approve or delete anything.

Question 5

How does human-in-the-loop approval work over MCP?

Accepted Answer

An assistant calls request_action to propose one of four allow-listed actions — raise a remediation ticket, notify the owning team, request a playbook run, or escalate an SLA breach — with a subject and a reason. That creates a pending request in the organization's approval inbox and nothing more. A person holding the remediation approve capability reviews it inside VulnTrek and approves or denies it with a reason; requesters cannot approve their own request and proposals expire (72 hours by default). The assistant then calls get_action_status to read the decision and any dispatch outcome. There is deliberately no MCP tool that approves, denies or executes an action, so an agent can never self-authorise, and every proposal and decision is recorded in the audit ledger.

Question 6

How is multi-tenant isolation guaranteed over MCP?

Accepted Answer

Each tool call executes as the authenticated user against database row-level security, using a short-lived token from the OAuth flow. Organization scope is resolved server-side from that identity, never from a parameter the model can set, so an assistant cannot be prompted into reading another tenant's data.

Question 7

Does conversational access weaken our audit position?

Accepted Answer

It strengthens it. Access inherits the platform's capability-based RBAC and tenant isolation, and gate evaluations produce evidence: an append-only verdict ledger entry plus a hash-chained compliance evidence record mapped to ISO 27001 change-management and DORA Article 6 controls. Blocked builds become change-control proof automatically.

Question 8

How does the same gate run in CI?

Accepted Answer

The gate is available three ways from one policy: as the security_gatekeeper MCP tool, as a REST endpoint for pipelines, and through a dependency-free CI client that fails the job on a blocking verdict and uploads the evidence artefact. The verdict a developer sees in their assistant is the verdict the pipeline enforces.

Not just a dashboard for security teams — the security layer inside every developer's workflow.

What makes this unusual

Connect once. Then just ask.

The published tool set

A free public threat intel MCP server, alongside the tenant one

Playbooks, not a blank prompt

The security contract