MCP server
Connect Claude or an IDE to your supply-chain data over MCP.
TraceGuard ships a Model Context Protocol server, so an AI assistant (Claude, an IDE) can read and act on your supply-chain data — bounded by the same scopes and row-level security as everything else. A token can never see or change anything its owner couldn't.
Connect
The server speaks Streamable HTTP at https://mcp.traceguard.io. In the app
this lives under Integrations → AI Agents — pick your client below to get the
server URL and a ready-to-paste config (the same flow as the product):
https://mcp.traceguard.io- 1. In Claude: Settings → Connectors → Add custom connector.
- 2. Paste the Server URL above.
- 3. Sign in to TraceGuard and approve — pick read-only vs read & write and which orgs/projects.
Works on claude.ai and Claude Desktop.
On first connect you sign in to TraceGuard and choose scope — read-only vs read &
write, and which orgs/projects. See OAuth for the flow,
or expand Use an API token above for headless/CI setups (tgm_…).
First call
Run whoami first — it reports the token's identity, granted scopes, and any
org/project restrictions, so you know exactly what this connection can do.
Tool catalog
Read tools are available whenever the matching read scope is present; write tools
(create_vex, record_finding_decision, trigger_scan) only appear when the
token holds the corresponding write scope.
| Group | Tools |
|---|---|
| Navigation | whoami, list_organizations, list_projects |
| Inventory | list_sboms, get_sbom, list_components, list_dependencies |
| Vulnerabilities | list_vulnerabilities |
| Findings & triage | list_findings, list_finding_decisions, list_vex, list_exclusions |
| Dashboard & search | org_dashboard_stats, kev_epss, search |
| Write (scope-gated) | create_vex, record_finding_decision, trigger_scan |
Getting oriented
Data is hierarchical: organizations contain projects. Most tools take an
organization_id (from list_organizations); many also accept a project_id
(from list_projects). Use the list_*, search, and dashboard tools to find
ids before calling a write tool — and confirm specifics with the user first.
Always confirm before invoking a write tool. create_vex,
record_finding_decision, and trigger_scan change your data.