Connect an MCP client

Connecting has two parts. First, an administrator registers the AI client in RiskVault. Then each user adds the RiskVault MCP server in that client and approves access.

Client menus change over time, but the required values are the same. The examples below use generic labels such as Add connector or Add MCP server.

Information to obtain first

Ask your RiskVault administrator for:

  • the RiskVault MCP server URL, normally ending in /mcp;
  • the registered client ID;
  • the client secret, if the registration is confidential;
  • the scopes the client was approved to request;
  • confirmation that your account is expected to use the connection.

Never ask an administrator to send a client secret in an ordinary chat channel. Use your organization's approved secret-sharing method.

Add RiskVault to the AI client

  1. Open the AI client's Settings.
  2. Find Connectors, Integrations, or MCP servers.
  3. Choose Add custom connector or Add MCP server.
  4. Enter a recognizable name, such as RiskVault.
  5. Enter the MCP server URL exactly as supplied.
  6. If prompted for OAuth settings, enter the registered client ID.
  7. Enter the client secret only if the administrator registered a confidential client.
  8. Save, then choose Connect or Authorize.

Image needed: Generic external AI client connection dialog showing Name, MCP server URL, Client ID, and optional Client Secret. Use obviously fictional values.

The client opens RiskVault in your browser.

  1. Confirm the address belongs to your organization's RiskVault site.
  2. Sign in using your normal RiskVault account.
  3. Confirm the displayed client name is the one you intended to connect.
  4. Review every requested capability, such as risk summaries or portfolio statistics.
  5. Review the descriptions of data covered and the token lifetime.
  6. Select Allow access only if everything is expected. Otherwise select Deny and contact an administrator.
  7. Return to the AI client and wait for its connected status.

Image needed: RiskVault Authorize Access page showing the client name, requested scopes, data classification information, token lifetime, Allow access, and Deny.

Registering a client never grants access by itself. Your consent creates the delegated connection for your own account.

Test the connection

Begin with a narrow, non-sensitive request:

Search RiskVault for risks with “vendor” in the title or description. Return the RR number, title, and status only.

Then verify one returned risk in the RiskVault application. This confirms that the client is connected and that the response matches the record you can see.

Connection lifetime

Access tokens expire after 15 minutes. RiskVault can refresh an active connection, but refresh access stops after one hour of inactivity and expires after seven days regardless of use. An administrator can disable or delete the client immediately.

If the client asks you to sign in again after inactivity, repeat the consent review rather than treating it as an error.

Disconnect

Use the AI client's connector settings to disconnect or remove RiskVault. If the connection should be blocked for everyone, ask an administrator to disable or delete the client registration. For suspected credential exposure, contact an administrator immediately.