MCP Server
Connect
The PromptArmor MCP server brings your vendor risk data into the tools you already work in. It has no AI of its own. Use it for anything - from reviewing a vendor, working through open alerts, checking questionnaire answers, and more. Existing permission levels and audit trails apply.
Server URL:
https://api.platform.promptarmor.com/mcp
Add the server URL as a custom connector in your AI client. At authorization you pick view only or view and update, and you can allow, ask, or block each tool individually.
What You Can Do
Try asking
- Which of our vendors have a high risk level for customer data used for training?
- Which of our high risk vendors are we not continuously monitoring?
- Which of our vendors use OpenAI models?
- Which of our business units has the highest average vendor risk score?
- Which of our alerts are still open, and what do they need?
Example workflows. Write your own for the ones your team runs.
- Find duplicative vendors: Where are we paying for the same capability twice?
- Check questionnaire answers: What do the questionnaire answers mean for the vendor's risk cards?
- Work through open alerts: What do our open alerts mean for us, and how should we resolve them?
What You Can Read
| Area | Fields |
|---|---|
| Vendor Reports | Executive summary, Data flow, Risk cards, AI features, AI subprocessors |
| AI Inventory | Status, Business criticality, Business unit, Tags, Custom fields |
| Use Cases | Use case type, Business owner, Business unit, Inputs, Outputs |
| Continuous Monitoring | Description, Action item, Risk level, Tags, Resolution state |
| Questionnaires | Questions, Answers |
| Configuration Forms | AI features turned on, Policy recommendations adopted |
| Coverage | Inventory, Report, Monitored |
| Report Requests | Pending, Rejected, Flagged, Canceled, Completed |
| Metrics | Risk over time, Business unit risk, Provider concentration, Business unit concentration, Tag concentration, AI usage, Alert trend |
What You Can Change
| Area | Fields |
|---|---|
| Vendor Records | Status, Business criticality, Business unit, AI disabled, Custom fields |
| Risk Cards | Risk level, Risk acceptance, Mitigating controls, Policy recommendations |
| Use Cases | Create, Update, Delete |
| Alerts | Notes, Mitigating controls, Risk level, Tags, Resolution |
| Vendors | Add a vendor, Remove a vendor, Cancel a report request |
Tools
Read-Only
| Tool | What it does |
|---|---|
| Search Vendors | Search for vendors globally. |
| List Vendors | List the AI vendors in the inventory. |
| Get Vendor | Read the vendor report for one or more AI vendors. Returns overview + summary by default; full reports are long. |
| Search Alerts | Find continuous-monitoring alerts. |
| Get Alert | Read continuous-monitoring alerts in full: the description, the action item, risk level, tags, and the resolution state. |
| Get Metrics | Aggregate metrics for the inventory and its alerts, one topic per call. |
| Get Request Status | Check a vendor report request created with add_vendor. Returns pending, rejected, flagged, canceled or completed, and once complete the vendor identifier to pass to get_vendor. Reports are not instant. |
| List Filter Values | Look up the controlled vocabularies the other tools' filters accept: alert tags, risk-card keys, vendor statuses, business units and custom fields, vendor tags, and the model providers and AI subprocessors actually present in this inventory. |
Write/Delete
| Tool | What it does |
|---|---|
| Update Vendor | Update one vendor's record: status, business criticality, business unit, whether AI is disabled, and custom-field values. Send only the fields to change: omitted fields are untouched. |
| Update Risk Card | Record a risk decision on a vendor's risk card: override its risk level, with the risk acceptance and the mitigating or compensating controls that justify it, and mark the card's policy recommendations enabled or disabled. This writes to the card's audit trail and recomputes the vendor's risk score. |
| Update Alert | Record a decision on a continuous-monitoring alert: resolve it, attach the mitigating or compensating controls that justify the decision, adjust its risk level, add or remove tags, or add notes. This writes to the audit trail. |
| Record Use Case | Record how a vendor's AI is used: what it does, who owns it, which business unit runs it, the data in and out, and its additional settings (on-premises, trusted sources, no sensitive data). The inputs, outputs and settings determine the use case's risk score. |
| Update Use Case | Update a recorded use case: its name, owner, business unit, description and settings, or its data inputs and outputs. Omitted fields are untouched, and a refused call writes nothing. |
| Add Vendor | Add a vendor to the AI inventory: its report, continuous monitoring, or both (add picks which). |
| Remove Vendor | Remove a vendor's report, continuous monitoring, or both from the AI inventory. |
| Delete Use Case | Delete a use case. |
| Cancel Request | Cancel a pending report request. |