Connect your AI agent

Point any MCP client at your tenant — authentication, project scope and approvals.

CISO360AI ships a native Model Context Protocol (MCP) server, so you can connect your own agent — Claude, GitHub Copilot, ChatGPT, Microsoft Copilot, Cursor, or any MCP client — directly to your tenant. It is available on every plan, including Free.

The server speaks streamable HTTP and derives your organisation from your credential, so no organisation or project appears in the URL.

Endpoint

https://api.ciso360.ai/mcp

Authentication

Two options:

An API key — Authorization: Bearer csk_..., created in Settings → API Keys. Prefer an agent key with the narrowest scopes that still covers what your agent needs.
OAuth 2.1 with Dynamic Client Registration (DCR) — for clients that support it.

Either way your organisation is derived from the credential, and cross-organisation access is rejected.

Treat the key like a password

An API key is a bearer credential bound to your user and one organisation. Keep it out of source control, and issue a separate narrowly-scoped key per agent so you can revoke one without disturbing the others.

Client configuration

Any MCP-compatible client takes the same shape:

{
  "type": "http",
  "url": "https://api.ciso360.ai/mcp",
  "headers": { "Authorization": "Bearer csk_..." }
}

Project scope

Scope behaves differently for reads and writes, deliberately:

Read tools return every project in your organisation by default, each result tagged with the project it came from. Pass an optional project_id to narrow to one. This is what lets a single agent run a whole multi-project programme.
Write tools require an explicit project_id. There are no silent cross-project writes.

Call list_projects first to discover the project ids available to your credential.

Consultancies, MSSPs and vCISOs use a scoped key — or OAuth across your organisations — one per organisation, with project sharing where a third party needs access.

What an agent may do on its own

Not every tool is equal, and the distinction is enforced server-side rather than left to the agent:

Action	Behaviour
Reads	Run freely within the credential's scope.
Low-risk triage — marking a finding `false_positive` or `suppressed`	Runs autonomously, recorded in the audit log.
Destructive actions and risk acceptance	Require a human approval step in the app before they take effect.

Agent keys are deny-by-default and can never run destructive tools, whatever the agent asks for.

Discovering the tools

The authoritative tool list and its JSON schemas are discoverable at runtime through the MCP tools/list method once you are connected — that is always current, where any list written here would drift. A machine-readable overview also lives at api.ciso360.ai/llms.txt.

The REST API

For scripts and machine-to-machine work that is not agent-driven, the REST API takes the same csk_... key:

OpenAPI schema: api.ciso360.ai/api/openapi.json
Interactive explorer: api.ciso360.ai/api/docs

For AI agents, the MCP server is the recommended path — the scope gating and approval behaviour described above are built into it.