Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
The Coverbase MCP server lets AI assistants and agentic tools query and manage your third-party risk and procurement program through natural conversation. Ask about vendors, assessments, findings, contracts, obligations, and subprocessor exposure, and the assistant pulls answers directly from your Coverbase account, scoped to your permissions. The server implements the Model Context Protocol, an open standard for connecting AI assistants to external systems. It works with any MCP-compatible client.

​
Supported clients

Claude

claude.ai web, Claude Desktop, Claude for Chrome

Claude Code

Anthropic’s command-line agentic coding tool

Cursor

The AI-native IDE

VS Code

GitHub Copilot agent mode (native MCP)

Microsoft Copilot Studio

MCP tools for Copilot agents

Cline

The VS Code coding agent

Goose

Block’s open-source AI agent

MCP Inspector

The official Anthropic debugging client
If your tool speaks MCP over OAuth 2.0 with Streamable HTTP transport, it will work with our server. Email support@coverbase.ai if you’d like us to add yours to the test matrix.

​
What you can do

The server exposes 11 tools, each dispatching many operations, across read and write capabilities.
File a complete vendor intake request in conversation: the assistant researches the vendor and confirms its identity with you, surfaces existing vendors that already cover the need, runs the pre-qualification and duplicate checks your portal configures, then walks the inherent risk questionnaire one question at a time. Reviewers can work the pending queue the same way, approving, rejecting, or requesting follow-up. See Vendor intake in chat.
Search vendors by name, status, tier, owner, or tags. Pull a full vendor profile in one call: people, assessments, findings, contracts, engagements, obligations, radar alerts, security cases, and SOC 2 documents. Read a vendor’s latest applied bill of materials (SBOM, AIBOM, HBOM, SaaSBOM) and its components, or its full BOM upload history. Surface portfolio-wide views including highest-risk vendors, evidence health, and assessment metrics.
Search assessments by vendor, status, or assignee. Get full assessment detail in one call: control evaluations, findings with titles, people, supporting documents. List control sets, controls within a set, and per-control evaluation results. Start new assessments, update fields, and manage assessment plans.
Search findings scoped to a vendor or assessment, or org-wide, with full titles, categories, assignees, due dates, and status. List follow-ups attached to assessments. Search and update obligations extracted from vendor documents. Create new findings or obligations with explicit confirmation.
Search contracts by vendor or status, and get full contract detail. List vendor engagements and vendor documents (evidence files) for a vendor or org-wide. Get evidence health summaries.
Search across all vendors’ SOC 2 reports and custom relationships to find which vendors depend on a specific nth-party. The question that takes hours in most TPRM tools and seconds here: “which of our vendors use AWS as a subprocessor?”
Rank controls by how often they flag an issue across recent assessments to find the false-positive-prone ones, then tune a control’s expectation, evaluation instructions, or evidence requirement so it stops misfiring. Material edits create a new version rather than overwriting. Clear individual false positives on a single assessment, and re-run the analysis against the new guidance.
List radar alert events for a single vendor or across the org. List and update radar detectors configured for the org. Seed a radar event manually, dismiss a noisy alert (optionally suppressing similar ones), and start a reassessment from an event with its impacted vendors.
Get an org activity digest in one call: recent assessments, open findings, radar alerts, audit trail entries, and notifications. List the audit trail for any supported object.
List and add notes on any platform object. List and update tags, custom field configurations, custom field values, workflow automations, assessment plans, questionnaires, status labels, and org users.

Full tool reference

Every route on all 11 tools: the read kind values, the report catalog and their parameters, and the complete write matrix.
Every tool that creates, updates, or deletes data requires a confirm parameter set to true. The assistant is expected to surface the proposed change in chat and wait for your approval before executing. This human-in-the-loop pattern applies uniformly across all write tools.

​
Server endpoint

​
Connecting

Claude Code

claude mcp add --transport http coverbase https://mcp.coverbase.app/mcp

Claude.ai

Add a custom connector in Settings → Connectors

Claude Desktop

Add a custom connector in Settings → Connectors

Cursor

Add as a remote MCP server in Cursor settings

VS Code

Native MCP in GitHub Copilot agent mode

Microsoft Copilot Studio

Add as a Model Context Protocol tool

Other clients

Any MCP client with OAuth 2.0 and Streamable HTTP transport

​
Requirements

  • An active Coverbase account on a plan that includes API access.
  • An MCP-compatible AI assistant or client.
  • The MCP server uses OAuth 2.0. Your permissions in Coverbase determine what the connected assistant can see and do.

Vendor intake in chat

Run a full intake request in conversation: identity confirmation, alternatives, screening, and the questionnaire.

Tool reference

Every route on all 11 tools, with the parameters each accepts.

Canned prompts

Nineteen scripted workflows you can invoke by name instead of describing.

Example prompts

Realistic phrasing for the workflows customers run daily and weekly.

Roles and permissions

How read-only versus read/write is decided, and how it maps to your Coverbase role.

Privacy and security

How we handle credentials, what we log, what we don’t retain, and how to revoke access.