🧪 This feature is available as part of a private beta.

The Intigriti Company MCP server connects supported AI assistants to your company data through the Model Context Protocol (MCP). Once connected, you can query and, when explicitly permitted, update programs, submissions, assets, groups, and related platform data using natural language.

MCP uses the same External API integration, token scopes, company context, and permissions as the REST API. It does not replace the REST API, and your existing REST API integrations continue to work unchanged.

🔓Subscriptions: Starter, Core, Premium, Enterprise

Before you begin

Make sure that you have:

An Intigriti company account with permission to create External API integrations.
A supported MCP client, such as OpenCode, Claude Code, Claude Desktop, Cursor, or VS Code with GitHub Copilot Chat.
Permission to access the company data and actions required for your workflow.

The Intigriti MCP server is hosted remotely. You do not need to install an npm package, run a local stdio server, store tokens in a local credentials file, or configure a login helper.

Create an MCP connection

⚙️ Roles: Company Admin

Go to Admin > Integrations > Intigriti external API/MCP.
Open the connection settings and select Add connection.
Leave Enable PKCE turned on. PKCE is enabled by default and is the recommended authentication mode for MCP clients.
Add the redirect URL required by your MCP client.
Select the token scopes required for your workflow.
Create the connection and copy the Client ID shown in the credentials modal. The credentials modal may also display a client secret, but PKCE clients do not need to use it.

💡 Note: PKCE does not require a client secret during token exchange. The integration may still display a generated secret, but it is not used for PKCE authentication.

Add a redirect URL

Native and desktop MCP clients use a temporary local port during authentication. Add the redirect URL required by your client to the connection:

MCP client	Redirect URL
Native MCP clients	`http://localhost` with any port
MCP Inspector	`http://localhost:6274/oauth/callback`

Redirect URLs must use https://, except for http://localhost callbacks used by native and desktop applications.

Select scopes

Apply the principle of least privilege and select only the scopes required for your workflow.

Scope	Purpose
`core_platform:read`	Read programs, submissions, users, groups, and company assets.
`core_platform:write`	Update submissions, post comments, and manage supported program data.

Reward system scopes are not available for MCP connections.

⚠️ Beware: The core_platform:write scope allows an AI application to make changes in Intigriti. Start with read-only access unless you have reviewed and approved the intended workflow, permissions, and safeguards.

Connect your MCP client

Use this remote MCP endpoint:

<https://api.intigriti.com/external/company/mcp>

Your MCP client discovers the Intigriti authorization server from the endpoint. When you connect for the first time, the client opens your browser so you can sign in to Intigriti and complete 2FA or SSO when configured.

MCP uses OAuth 2.0 Authorization Code with PKCE. The MCP client exchanges the authorization code for an access token without using a client secret. The data and tools available to the client remain limited by your Intigriti user permissions, the connection's company, and the selected scopes.

For client-specific configuration and examples, go to the MCP client setup documentation.

Verify the connection

Open your MCP client and confirm that the Intigriti server is connected.
Start with a read-only request, for example:

What programs do I have on Intigriti?

Confirm that the result matches the programs available to your Intigriti account.
If you deliberately enabled write access, test an approved low-risk workflow and verify the result in Intigriti.

Your MCP client decides how to interpret requests and which tools to call. Verify important results in Intigriti before making security, remediation, or program-management decisions.

MCP Tools

With the exceptions listed below, MCP exposes an approved subset of External API capabilities as explicitly registered tools. MCP does not automatically expose every REST API operation. Access remains subject to your Intigriti permissions, selected scopes, and enabled features.

The following External Company API operations are not exposed through MCP:

ImportSubmission: importing submissions is not supported.
AddSubmissionAttachment: uploading attachments to submissions is not supported.
ExportSubmissionPdf: exporting a submission as a PDF is not supported.
ExportSubmissionCsv: exporting a submission as a CSV file is not supported.
AddCompanyBonus: creating company bonuses is not supported.
DeleteCompanyBonus: deleting company bonuses is not supported.
RewardSystem.*: reward-system tools are not available through MCP.

Example prompts

Depending on your permissions and selected scopes, try prompts such as:

CISO or security leader

“Give me a brief of all high and critical submissions from the last 30 days. Highlight unresolved items that need attention.”
“Identify recurring vulnerability themes across our programs this quarter.”

Program manager

“Give me a weekly program health report: new submissions, backlog by severity, and items awaiting feedback.”
“Create a draft update for [program] about [topic]. Do not publish it.”

Security analyst

“Build my morning triage queue: new submissions from the last 24 hours, ordered by severity.”
“Summarize submission INTIGRITI-12345: affected endpoint, proof of concept, impact, recommended solution, and unanswered questions.”
“Update INTIGRITI-12345 to High using this CVSS vector: [vector]. Show the proposed change before applying it.”

Developer or engineer

“Show unresolved submissions affecting [asset or domain], sorted by severity, with the key remediation details.”
“Explain INTIGRITI-12345 as an engineering ticket, including reproduction steps, impact, suggested fix, and verification checks.”

Best practices

Start with core_platform:read unless your workflow requires write access.
Connect Intigriti only to MCP clients approved by your organisation.
Review active connections and scopes regularly.
Do not share access tokens. An access token is equivalent to session credentials.
Verify important outputs and changes in Intigriti.
Delete connections that are no longer required to invalidate their tokens.

MCP