VISO TRUST MCP Server is a Model Context Protocol (MCP) server used to integrate the capabilities of the VISO TRUST API with AI assistants.
Purpose: Access and manage VISO TRUST third-party risk projects through AI assistants.
Main capabilities: The project provides a hosted remote server, so users can use it without building, running, or self-hosting it. Connect any MCP client to the hosted endpoint, use Streamable HTTP transport, and authenticate with a VISO TRUST API token. The tools exposed by the server cover operations such as assessments, relationships, vendor directories, audit logs, Webhooks, and intelligence reports. Specific tools include: get assessment details and summaries, create assessments, set assessment expiration times, create follow-up assessments, query user audit log events (up to 500), query polymorphic audit log event records, list business cases, list data types, search vendor metadata, get vendor information, get relationship details, list relationship assessments, create relationships, update relationships, partially update relationships, search relationships by domain or name, create tags, and relationship lifecycle management (onboarding, offboarding, archiving, setting lifecycle management). In addition, there are Webhook management tools (list, get, create, update, delete) and tools for creating BitSight and SecurityScorecard intelligence reports.
How to use: Users can connect any MCP client to the hosted endpoint, using Streamable HTTP transport and a VISO TRUST API token for authentication. For how to generate an API token, see the VISO TRUST support documentation. For local or self-owned infrastructure deployment, the server supports running directly through Java, Gradle, or Docker. The remote profile is designed for remote MCP support via Streamable HTTP, runs on a Tomcat servlet on port 3001, with the MCP endpoint at POST /mcp, stateless mode, and can scale horizontally behind a load balancer without session affinity. Clients should connect to a single Streamable HTTP endpoint .../mcp; the legacy SSE endpoint is no longer served. Local development and direct stdio communication use the default profile. Also provided are the VS Code installation button and manual setup instructions, as well as usage examples for Claude Desktop and other MCP clients. The steps for building the MCP server JAR file and running MCP Inspector are also explained in the documentation. The project uses GitHub Actions for continuous integration and deployment, including code format checks, building the JAR, updating the version on release, uploading the JAR to GitHub release, and building and pushing the Docker image to Docker Hub. Docker Hub publishing requires configuring the DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets.
Applicable scenarios: Suitable for organizations that need to integrate VISO TRUST third-party risk management capabilities into AI assistants, for example, querying assessment status, managing vendor relationships, creating assessments, viewing audit logs, managing Webhooks, and importing BitSight and SecurityScorecard intelligence reports through AI assistants. It is also suitable for scenarios that require local or self-owned infrastructure deployment of the MCP server, as well as scenarios that want to use Streamable HTTP to integrate with web-based AI assistants.
Limitations: Using the hosted remote server requires a VISO TRUST API token; for how to generate one, see the VISO TRUST support documentation. Local deployment requires Docker (optional, for containerized deployment), MCP Inspector (optional, for testing), Java, and Gradle. The remote profile runs on port 3001, and the MCP endpoint is located at POST /mcp. The legacy SSE endpoint (/sse + /mcp/message) is no longer served. Audit log query results are limited to a maximum of 500 records. Specific information such as fees and pricing is not currently provided in the materials.