vCISO Lite offers a Model Context Protocol (MCP) server and a Claude Code plugin that let you connect your own AI assistant—such as Claude, Claude Code, Claude Desktop, or Cursor—to your vCISO Lite data. This is optional and happens only when you choose to connect a client.
- You direct the connection: Nothing is shared with an AI client unless you install the plugin or add the MCP server and sign in. You authorize access through OAuth—we never receive or store your AI provider's credentials, and your AI provider never receives your vCISO Lite password.
- What a connected client can access: Once connected, the AI client can read the vCISO Lite data your role and organization already permit—such as compliance posture, findings, vendor records, and audit history—by calling scoped tools. Write actions (for example, triaging a finding) happen only when you direct them. Access is limited to your own organization(s) and your existing permissions; connecting a client never widens what you can see.
- Data leaves to the provider you choose: When you use a connected AI client, your prompts and the vCISO Lite data returned to answer them are processed by that AI provider (for example, Anthropic) under that provider's own terms and privacy policy—not ours. We are the source of the data; you and the provider you chose control what happens to it inside that assistant. Review your AI provider's privacy terms before connecting.
- We log the calls—never to train: For security and audit, we record metadata about tool calls made through the MCP server (which tool, when, by whom, and the outcome) in your organization's tamper-evident audit trail. We do not use this, or any of your content, to train AI models.
- Disconnecting: You can revoke a client's access at any time from your account settings or by uninstalling the plugin, which stops further data sharing immediately.
For setup details, see our Developers page.