Bring Coverbase agents into your stack with MCP.
Which vendors have open findings due this month?
Open the linked vendor record before you act.
Your risk data lives in one system, but your team works across many. Switching tools to answer a simple question kills momentum, and the agents people use every day have no safe, governed way to reach your program of record.
Coverbase ships a Model Context Protocol server that exposes your vendors, assessments, controls, findings, contracts, obligations, and radar alerts to the clients your team already uses. Ask questions in plain language and get answers grounded in live data. Then let agents take real, permission-scoped actions: create and update records, set tags, add notes, trigger assessments. In-app agents bring the same power inside Coverbase itself, and every action is governed by your roles and captured in the audit trail.
Agents that connect to and act on your risk program.
- 01
A Model Context Protocol server for your risk program
Coverbase exposes your vendors, assessments, controls, findings, engagements, contracts, obligations, questionnaires, services, and radar alerts through a standards-based MCP server.
- Connect from Claude, your IDE, or any MCP-compatible client.
- Ask questions in plain language, such as “Which critical vendors are past due on SOC 2 review?”, and get answers grounded in your live program data rather than a generic model's guess.
- 02
Agents that read and act, with guardrails
Beyond read-only queries, agents can take real actions: create and update vendors, services, findings, controls, assessments, questionnaires, and custom fields, set tags, and add notes to any object.
- Every action is scoped to the authenticated user's organization and permissions.
- Reads are organized by domain (vendor search, risk summaries, assessment evals, contract obligations, radar alerts) so agents fetch exactly what they need.
- 03
In-app agents where the work happens
Agents live inside Coverbase, not in a separate chat window.
- Trigger an assessment, draft a follow-up, or summarize a vendor's risk posture without leaving the record you're on.
- Portfolio risk, assessment metrics, evidence health, and review-queue reports are all available to agents on demand.
- 04
Governed, auditable, and on your terms
Because everything runs through scoped permissions and a single mutation surface, agent activity is governed the same way your team is.
- Every change an agent makes is captured in the audit trail.
- You set what agents can see and do.
Real impact for risk, security, and platform teams.
Meet your team in their tools
Work from the AI client you already use, without opening a new tab.
Natural-language answers
Ask about your program in plain language and get grounded, real-time answers.
Agents that take action
Create, update, tag, and annotate records as well as read them.
Permission-scoped by default
Every query and mutation respects your org's roles and permissions.
Fully auditable
Every agent action lands in the audit trail, the same way a person's actions do.
“Our analysts ask Coverbase questions straight from the tools they already live in, and agents draft the follow-ups for them. It’s all scoped to our permissions and logged, so we got the productivity without giving up control.”
Standards-based MCP
Works with Claude, IDEs, and any MCP-compatible client.
Read and write
Query the whole program and act on it through one surface.
Permission-scoped
Agents inherit your org's roles, not a backdoor.
Audit everything
Every agent action is logged end to end.
Ask your vendor record directly.
We expose twelve MCP tools over Streamable HTTP and OAuth 2.0. Nine query your risk data, one creates reports, one discovers available capabilities, and one makes permissioned changes after confirmation. You need a Coverbase account with API access.
Server endpoint
Use this URL in an MCP client that supports remote Streamable HTTP and OAuth.
https://mcp.coverbase.app/mcp| Tool | What it reaches | Access |
|---|---|---|
query_vendors | Vendors, evidence, nth-party use and risk summaries | Read |
query_assessments | Assessments, control evaluations and follow-ups | Read |
query_findings | Findings and vendor commitments | Read |
query_engagements_contracts | Engagements, services, contracts and obligations | Read |
query_controls | Controls and control sets | Read |
query_questionnaires | Questionnaires and intake sessions | Read |
query_rfps | RFPs, submissions and comparisons | Read |
query_radar | Radar detectors, alerts and reassessments | Read |
query_platform | Notes, audit trail, tags, fields and workflows | Read |
get_report | Portfolio, assessment and evidence reports | Read |
mutate | Permissioned create, update and other documented changes | Write with confirmation |
mcp_capabilities | Available routes and parameters for this connection | Discovery |
Connect the client you use.
Choose your client and connect it to your Coverbase program.
Claude Code
Add the remote server using the documented HTTP transport command. Then open Claude Code, run /mcp, choose Authenticate and finish Coverbase OAuth in the browser.
claude mcp add --transport http coverbase https://mcp.coverbase.app/mcpClaude.ai or Claude Desktop
Open Settings, then Connectors. Add a custom connector named Coverbase with the server endpoint above. Choose Connect and approve the Coverbase OAuth request in the browser.
Cursor
Open Cursor settings, then MCP and Add new server. Enter the endpoint above as a remote server. Cursor starts the OAuth flow on first use. Coverbase also publishes a JSON configuration in its client guide.
VS Code and Copilot
Coverbase documents a Streamable HTTP server entry in VS Code settings for GitHub Copilot agent mode. Reload VS Code and sign in when prompted. See the exact configuration before setup.
Ask about work already in your program.
- Which vendors have open findings due this month?
- Which of our vendors depend on a named sub-processor?
- Summarize the latest assessment for a selected vendor and link its evidence.
- Show the review queue for open findings and in-progress assessments.
What you can ask depends on the records you can access.
What a connected assistant can do.
Permissions, clients, and the actions you approve.
What is MCP?
Model Context Protocol lets supported AI clients use external tools. Ours connects those clients to your Coverbase program.
Which clients have setup guides?
We provide instructions for Claude Code, Claude.ai, Claude Desktop, Cursor, and VS Code with GitHub Copilot.
Which plan includes access?
You need a Coverbase account on a plan with API access. Ask our team which plan applies to you.
Can an assistant write without confirmation?
No. Each write requires a write-capable role, the mcp:write scope, and an explicit confirm=true argument.
How do I revoke access?
Disconnect the OAuth connection in Coverbase account settings or in your client.