What MCP is

MCP stands for Model Context Protocol. It is a standard way for an AI assistant to discover and use tools supplied by another application. In RiskVault, MCP lets an approved AI client ask RiskVault for selected risk information instead of requiring a user to copy and paste that information into a chat.

For example, after a secure connection is approved, you could ask an AI assistant to:

  • find risks mentioning a supplier or system;
  • summarize a specific accessible risk;
  • count or summarize portfolio-level risk information when authorized.

The AI assistant chooses an appropriate RiskVault tool, RiskVault checks the signed-in user's access, and only a bounded response is returned.

You ask a question
        ↓
AI client selects a RiskVault MCP tool
        ↓
RiskVault verifies the client, user, scope, and data rules
        ↓
RiskVault returns an approved, limited result
        ↓
The AI client explains the result to you

Image needed: Plain-language MCP flow diagram based on the sequence above, using icons for user, AI client, secure connection, and RiskVault.

MCP does not give an AI unrestricted access

RiskVault MCP is read-only and delegated:

  • An administrator must enable MCP and register the client.
  • You must sign in and explicitly allow the connection.
  • Requests run with your current RiskVault identity and permissions.
  • Business-unit, record-specific, and organization-wide exclusions still apply.
  • MCP returns only Public and Internal data. Confidential, Restricted, and Critical risk data is excluded, including risks made sensitive by linked assets.
  • Every MCP tool call is recorded for review.

If your RiskVault access changes, the new restriction applies to the client's next request. A previously issued token does not preserve old permissions.

Available RiskVault tools

Tool What it does Additional requirement
Risk search Searches accessible risks by text, RR number, description, or exact status and returns bounded summary pages. Risk-summary scope and access to each result.
Risk details Returns approved summary fields for one risk. Risk-summary scope and access to that risk.
Portfolio summary Returns approved aggregate register metrics, never individual risk details. Portfolio scope and full-register access.

The technical tool names are risk_search, risk_get, and portfolio_summary. Most users can simply describe the task naturally; the AI client calls the tool.

MCP versus AI writing help

These are separate features:

  • MCP connects an external AI client to read approved RiskVault data on your behalf.
  • AI writing help drafts text inside RiskVault through the AI endpoint configured by your administrator.

In both cases, treat generated text as a suggestion. Check accuracy, confidentiality, and appropriateness before relying on it.

What you need

Before connecting, confirm that:

  1. Your organization has enabled the MCP feature.
  2. An administrator has registered your AI client.
  3. You know the organization's RiskVault MCP server address.
  4. Your client supports remote MCP servers and OAuth authorization.
  5. Your administrator has provided a client ID and, for a confidential client, a client secret.

Continue to Connect an MCP client.