AI agent access
Cloudvisor's MCP server lets an MCP-compatible client inspect your tenant's findings, compare scan results, and retrieve remediation detail without granting the agent access to change AWS infrastructure.
Access is scoped from the MCP credential issued for your account. The server resolves the tenant before a tool runs; tools do not accept a tenant identifier.
Start here
The public site does not issue credentials. An account member with access to the integration opens the Portal and rotates the scoped MCP token there.
The token is shown once. Rotating again revokes the current token before the replacement is returned.
https://mcp.frame.devisory.eu/v1 Bearer ia_mcp_REPLACE_ME Replace the placeholder with the token from the Portal. Use a client that supports MCP over HTTP and bearer headers.
Customer read set
These tools read the authenticated customer's audit data. Finding lists default to 50 results and are capped at 200 per call.
list_findings List findings from the most recent completed scan with filters for severity, pillar, status, owner, source, and regressions.
get_finding Retrieve one finding by its stable finding ID, including its description and remediation recommendation.
get_divergence Show where self-assessment answers disagree with observed scan evidence.
diff_scans Compare scans and return findings that are new, resolved, or unchanged. Without arguments, it compares the two most recent completed scans.
list_capability_packs List pinned capability-pack metadata. This tool returns catalogue information, not tenant or AWS data.
Boundaries
MCP accepts an ia_mcp_* bearer token, not a Portal login token or Cognito
JWT. The token resolves one tenant, audience, and set of scopes before protocol
initialization. No tool accepts tenant_id, so a caller cannot select a
different tenant.
The customer profile's only non-read operation is create_issue when issue
writing is granted. It creates an idempotent remediation tracking record; it never
changes an AWS resource. Internal AWARE framework projections are not part of the
public customer catalogue.
Tokens expire after 90 days. The full value is returned only from the rotation response and is not retrievable later. Rotate a token when it expires or is exposed; the previous token stops working immediately.
MCP access is gated by the account's plan and MCP access setting. If AI agent access is not available in your Portal, contact your Cloudvisor administrator rather than trying the endpoint with a regular login credential.