For developers

MCP access to your
vCISO Lite environment.

Connect Claude Desktop, Cursor, or any client that speaks the Model Context Protocol to your vCISO Lite tools and data. OAuth 2.1 with PKCE, RFC 7591 Dynamic Client Registration, public OIDC discovery — no manual client provisioning.

vCISO Lite Enterprise account required. MCP access is gated to the Enterprise plan tier. Lower tiers don't have access to the MCP surface today.

Discovery endpoints

MCP clients discover the authorization server from the Protected Resource Metadata document. Three URLs is all your client needs:

MCP server resource
https://mcp.vcisolite.com/
Protected Resource Metadata (RFC 9728)
https://mcp.vcisolite.com/.well-known/oauth-protected-resource
Authorization Server Metadata (RFC 8414)
https://auth.vcisolite.com/.well-known/oauth-authorization-server

Claude Desktop

  1. Open Settings → Connectors → Add custom connector.
  2. Enter the MCP server URL: https://mcp.vcisolite.com
  3. Claude Desktop fetches the discovery documents, registers itself via DCR, and walks you through the vCISO Lite sign-in flow. No client_id to copy.
  4. Once signed in, you can ask Claude things like "What evidence do we have for SOC 2 CC6.1?" and the tool calls run against your live vCISO Lite environment.

Cursor

  1. Open Settings → MCP → Add MCP server.
  2. Server URL: https://mcp.vcisolite.com
  3. Cursor will register itself via DCR and prompt you to sign in. After consent, vCISO Lite tools are available in Cursor Agent mode.

Claude Code plugin

The fastest path. The vciso-liteplugin bundles the MCP connection and adds ready-made slash commands — two commands and you're connected:

# Add the marketplace, then install the plugin
claude plugin marketplace add vciso-lite/claude-plugin
claude plugin install vciso-lite@vciso-lite

On first use, Claude Code walks you through the same OAuth sign-in as the other clients. You then get slash commands layered on top of the raw tools:

  • /vciso-lite:risk-readiness — checks whether your org has enough connected data for risk numbers to be meaningful, and tells you what to wire up next.
  • /vciso-lite:posture — a board-readable brief: frameworks, open findings by severity, vendor risk, and top risks.

Source, docs, and the full command list: github.com/vciso-lite/claude-plugin (Apache-2.0). We've also submitted it to the Claude community marketplace; once approved it installs as vciso-lite@claude-community.

Build your own client

If you're building an MCP client from scratch, follow the standard OAuth 2.1 PKCE flow:

# 1. Discover the authorization server
curl https://mcp.vcisolite.com/.well-known/oauth-protected-resource
# → { "resource": "https://mcp.vcisolite.com",
#     "authorization_servers": ["https://auth.vcisolite.com"], ... }

# 2. Discover AS endpoints
curl https://auth.vcisolite.com/.well-known/oauth-authorization-server
# → { "authorization_endpoint": "...", "token_endpoint": "...",
#     "registration_endpoint": "...", "jwks_uri": "...", ... }

# 3. Register your client (RFC 7591)
curl -X POST https://auth.vcisolite.com/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "My MCP Client",
    "redirect_uris": ["http://localhost:7777/callback"]
  }'
# → { "client_id": "...", ... }

# 4. Run the standard OAuth 2.1 PKCE auth code flow against
#    authorization_endpoint / token_endpoint with your new client_id.

# 5. Call the MCP server with the resulting access_token.
#    The MCP transport is JSON-RPC 2.0 over HTTP POST at /mcp:
curl https://mcp.vcisolite.com/mcp \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list"
  }'
# → { "jsonrpc": "2.0", "id": 1,
#     "result": { "tools": [ {...}, {...} ] } }

Authorization model

The access token your client receives is a signed JWT (RS256, JWKS published at the AS Metadata jwks_uri). When you call the MCP server, the gateway validates the signature, checks the audience, and binds the request to your vCISO Lite identity using the vciso:user_id, vciso:organization_id, and vciso:plan_tier claims that vCISO Lite's identity-sync writes into your Zitadel user metadata.

Plan tier gates access:

  • ENTERPRISE — full read-only access to the vCISO Lite tool catalog: compliance scoring, control detail, findings, vendor posture, audit readiness, evidence search, and risk scenarios. Write/mutate tools (evidence generation, remediation workflows, attestations) are on the roadmap and will roll out as separate scope-gated surfaces.
  • STARTER / GROWTH / BUSINESS / ULTRA — MCP access is not available on these tiers today. Upgrade to Enterprise to enable MCP for your developers.

Supported redirect URIs

For security, DCR clients can only register redirect URIs that match one of:

  • http://localhost[:port][/path] — for desktop clients with a local listener
  • http://127.0.0.1[:port][/path] — same
  • Private-use URI scheme (e.g. claude://, cursor://) — for native deep links

https:// redirects are rejected by DCR to prevent open-redirector abuse. If you need a confidential web client for a service-to-service use case, reach out and we'll provision one manually.

Questions?

Email support@vcisolite.com and we'll route you to the right place.

Ready to connect your MCP client?

MCP access is available on the vCISO Lite Enterprise tier.

See pricingContact Sales