---
title: "Connect OneTrust to Claude: Manage Risk Audits & Assessment Tasks"
slug: connect-onetrust-to-claude-manage-risk-audits-assessment-tasks
date: 2026-09-01
author: Nidhi KN
categories: ["AI & Agents"]
excerpt: "Learn how to connect OneTrust to Claude using a managed MCP server. Automate DSARs, risk audits, and AI governance assessments with secure tool calling."
tldr: "Connect OneTrust to Claude Desktop using Truto's managed MCP server. This guide shows how to dynamically generate AI tools from OneTrust's API, handle DSARs, and enforce secure access controls."
canonical: https://truto.one/blog/connect-onetrust-to-claude-manage-risk-audits-assessment-tasks/
---

# Connect OneTrust to Claude: Manage Risk Audits & Assessment Tasks


If your team needs to connect OneTrust to Claude to automate Data Subject Access Requests (DSARs), track enterprise risks, or manage AI governance assessments, you need a [Model Context Protocol (MCP) server](https://truto.one/what-is-mcp-and-mcp-servers-and-how-do-they-work/). This server acts as the translation layer between [Claude's LLM tool calls](https://truto.one/best-unified-api-for-llm-function-calling-ai-agent-tools-2026/) and OneTrust's REST APIs. You can either [build and maintain this infrastructure yourself](https://truto.one/the-hands-on-guide-to-building-mcp-servers-for-ai-agents-2026/), or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses ChatGPT, check out our guide on [/connect-onetrust-to-chatgpt-manage-dsars-privacy-consent-logs/](https://truto.one/connect-onetrust-to-chatgpt-manage-dsars-privacy-consent-logs/) or explore our broader architectural overview on [/connect-onetrust-to-ai-agents-govern-ai-models-data-inventories/](https://truto.one/connect-onetrust-to-ai-agents-govern-ai-models-data-inventories/).

Giving a Large Language Model (LLM) read and write access to a sprawling governance, risk, and compliance (GRC) platform like OneTrust is a massive engineering challenge. You have to handle complex token lifecycles, map massive JSON schemas to MCP tool definitions, and deal with OneTrust's strict API data models. Every time OneTrust updates an endpoint or deprecates a legacy schema, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for OneTrust, connect it natively to Claude Desktop, and execute complex compliance workflows using natural language.

> Want to give your AI agents secure, authenticated access to OneTrust and 100+ other SaaS APIs? Let's talk about managed MCP architecture.
>
> [Talk to us](https://truto.one/book-a-demo/)

## The Engineering Reality of the OneTrust API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools over JSON-RPC, the reality of implementing it against specialized B2B APIs is painful. OneTrust is built to manage everything from GDPR cookie consent to AI governance and vendor risk. Its API reflects that immense scope.

If you decide to [build a custom OneTrust MCP server](https://truto.one/the-hands-on-guide-to-building-mcp-servers-for-ai-agents-2026/), here are the specific integration challenges you will face:

**Highly Relational and Nested Entity Structures**
OneTrust does not rely on simple flat records. If you want to log a risk against an AI model, you cannot just push a flat JSON object to a `/risks` endpoint. You must first query the Object Manager to get the AI Governance entity UUID, identify the correct risk template ID, find the internal UUIDs of the assigned risk owners, and link them all together. An LLM cannot simply guess this payload structure. A managed MCP server exposes tools with strictly defined JSON schemas that explicitly guide the LLM on exactly which IDs are required and where to find them.

**Asynchronous Jobs and Long-Running Tasks**
Many operations in OneTrust are not synchronous CRUD. When you trigger a large-scale data discovery scan, submit a bulk export of DSARs, or kick off an AI model assessment, the API immediately returns a 202 Accepted with a Job ID. You are responsible for polling a status endpoint to know when the operation is complete. If you build this yourself, you must teach the LLM how to poll - which consumes massive amounts of token context - or build a stateful background worker into your custom MCP server.

**Strict Pagination and Payload Constraints**
OneTrust enforces strict cursor-based and offset-based pagination depending on the module. Furthermore, their APIs often throw complex validation errors if you provide an invalid enum value for a workflow stage (e.g., trying to move an assessment to `COMPLETE` instead of `Completed`). Managing these variations and translating them into standard MCP error responses so the LLM can self-correct is a heavy maintenance burden.

## How to Create the Managed OneTrust MCP Server

Truto eliminates the need to hand-code tool definitions. Truto derives MCP tools dynamically from the integration's resource definitions and schema documentation. If an endpoint is documented, it becomes an AI tool automatically.

Each MCP server in Truto is scoped to a single integrated account (a connected OneTrust instance). The server URL contains a cryptographically hashed token that encodes the account, the allowed tools, and the expiration policies. 

You can create this server in two ways: via the Truto UI, or programmatically via the API.

### Method 1: Via the Truto UI

If you are setting this up for internal workflows, the UI is the fastest path.

1. Navigate to the **Integrated Accounts** page in your Truto dashboard and select your connected OneTrust account.
2. Click the **MCP Servers** tab.
3. Click **Create MCP Server**.
4. Select your desired configuration. You can filter by HTTP methods (e.g., only allow `read` operations) or filter by tags (e.g., only expose `compliance` tools).
5. Copy the generated MCP server URL. (e.g., `https://api.truto.one/mcp/a1b2c3d4e5f6...`)

### Method 2: Via the Truto API

If you are building an AI product and need to generate MCP servers for your end-users dynamically, you can use the Truto API.

The endpoint `POST /integrated-account/:id/mcp` validates the configuration, generates a secure token stored in a distributed key-value layer, and returns a ready-to-use URL.

```typescript
// POST https://api.truto.one/integrated-account/<onetrust_account_id>/mcp
// Headers: Authorization: Bearer <Truto_API_Token>

{
  "name": "OneTrust Compliance Agent",
  "config": {
    "methods": ["read", "write"],
    "tags": ["assessments", "dsar", "ai_governance"]
  },
  "expires_at": "2026-12-31T23:59:59Z"
}
```

The response provides the URL you will pass to Claude:

```json
{
  "id": "abc-123",
  "name": "OneTrust Compliance Agent",
  "config": { "methods": ["read", "write"] },
  "expires_at": "2026-12-31T23:59:59Z",
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}
```

## Connecting the MCP Server to Claude

Once you have your Truto MCP URL, you can connect it directly to Claude. No middleware, no proxy servers, no local code required.

### Method A: Via the Claude UI

If you are using Claude Desktop or the web interface (depending on your tier):

1. Open Claude and navigate to **Settings** -> **Integrations** (or **Connectors** -> **Add custom connector** depending on your specific client version).
2. Click **Add MCP Server**.
3. Paste the Truto MCP URL.
4. Click **Add**. Claude will instantly perform a handshake, discover the OneTrust tools, and make them available in your chat context.

*(Note: If you use ChatGPT, the flow is similar: Settings -> Apps -> Advanced settings -> Enable Developer mode -> Add Custom Connector).* 

### Method B: Via Manual Config File

For Claude Desktop power users, you can configure the MCP server by editing the `claude_desktop_config.json` file. Because Truto uses Server-Sent Events (SSE) over HTTPS, you use the official remote SSE client wrapper.

```json
{
  "mcpServers": {
    "onetrust-superai": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}
```

Save the file and restart Claude Desktop. The OneTrust tools are now active.

## Security and Access Control

Giving an LLM access to your compliance and risk data requires strict governance. Truto provides four layers of security for MCP servers:

*   **Method Filtering**: You can strictly limit the LLM to specific operation types. Setting `config.methods: ["read"]` ensures the server will only generate tools for `GET` and `LIST` endpoints. The LLM physically cannot mutate data.
*   **Tag Filtering**: Restrict the LLM to specific functional areas. By passing `tags: ["dsar"]`, the LLM will only see tools related to Data Subject Access Requests, hiding the AI Governance and Vendor Risk modules entirely.
*   **Expiration (TTL)**: You can pass an `expires_at` timestamp. Once reached, the distributed key-value store automatically purges the token, instantly revoking the LLM's access. Perfect for temporary contractor environments.
*   **Extra Authentication**: By setting `require_api_token_auth: true`, possession of the MCP URL is no longer enough. The client must also pass a valid Truto API token as a Bearer header to execute tools.
*   **Strict Rate Limit Handling**: Truto does *not* retry, throttle, or apply backoff on rate limit errors. When the upstream OneTrust API returns an HTTP 429, Truto passes that error directly to Claude. Truto normalizes the upstream rate limit info into standardized headers (`ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset`) per the IETF spec. The calling agent must handle its own backoff logic.

## Hero Tools for OneTrust

Truto automatically generates dozens of tools for OneTrust. Here are a few high-leverage tools your AI agent can use immediately.

### Submit a Global Opt-Out DSAR
**Tool**: `create_a_one_trust_cmp_dsar`
Submit a global opt-out Data Subject Access Request (DSAR) on behalf of a user directly into the OneTrust CMP.
> "A user emailed us from privacy@example.com requesting to opt out of all data selling. Please submit a global opt-out DSAR for them in OneTrust."

### Search AI Governance Entities
**Tool**: `one_trust_ai_governance_entities_search`
Search the AI Governance inventory for specific models, datasets, or AI systems by keyword. Returns full schema details and metadata.
> "Search OneTrust for any AI models related to 'facial recognition' and summarize their current workflow stage and associated risks."

### Launch a New Assessment
**Tool**: `create_a_one_trust_assessment`
Kick off a new assessment (like a PIA or Vendor Risk Assessment) using a specific template and assign it to respondents.
> "Launch a new Data Privacy Impact Assessment (DPIA) for the 'Project Phoenix' data asset and assign it to the lead engineer."

### Approve an Assessment
**Tool**: `one_trust_assessments_approve`
Move a submitted assessment to the Completed stage. 
> "Check the status of Assessment ID 4910. If all required questions are answered and the risk score is Low, approve the assessment."

### Create a Risk Record
**Tool**: `create_a_one_trust_risk`
Log a new risk in the OneTrust Risk Register, complete with description, risk owners, and target risk level.
> "Log a new risk in OneTrust regarding 'Unencrypted PII in S3 Bucket'. Assign it to the infrastructure group and flag the inherent risk as High."

### List SCIM Users
**Tool**: `list_all_one_trust_scim_v_2_users`
Retrieve a list of OneTrust users via SCIM v2 to audit access, roles, and group memberships.
> "Pull the list of all active OneTrust users and cross-reference it to see who has administrative access to the AI Governance module."

*To view the complete inventory of available OneTrust tools, schemas, and required parameters, visit the [OneTrust integration page](https://truto.one/integrations/detail/onetrust).* 

## Workflows in Action

When you connect Claude to OneTrust via Truto, you unlock complex, multi-step orchestration. Here is how a compliance officer or security engineer can use natural language to execute real-world workflows.

### Workflow 1: DSAR Triage and Processing

Privacy teams spend hours manually cross-referencing user data for DSARs. An agent can automate this entirely.

> **User Prompt**: "Find all open DSAR requests created in the last 24 hours. For each one, verify the user's identity status. If verified, advance the workflow stage to 'IN_PROGRESS' and leave an internal comment that processing has begun."

**Agent Execution Sequence:**
1.  **`one_trust_requestqueues_searches_search`**: The agent queries the DSAR module with a date filter for the last 24 hours.
2.  **`get_single_one_trust_datasubject_requestqueue_by_id`**: For each request found, the agent pulls the full payload to check the identity verification status.
3.  **`one_trust_requestqueue_movestages_bulk_update`**: For the verified requests, the agent updates the stage to `IN_PROGRESS` and appends the internal comment.

**Result**: The user gets a summarized list of all processed DSARs, saving the privacy team hours of manual clicking through the OneTrust UI.

```mermaid
sequenceDiagram
    participant Claude as Claude Desktop
    participant TrutoProxy as Truto Proxy API
    participant OneTrust as OneTrust API

    Claude->>TrutoProxy: tools/call (one_trust_requestqueues_searches_search)
    TrutoProxy->>OneTrust: POST /requestqueues/search
    OneTrust-->>TrutoProxy: 200 OK (List of DSARs)
    TrutoProxy-->>Claude: JSON Tool Result
    
    Claude->>TrutoProxy: tools/call (one_trust_requestqueue_movestages_bulk_update)
    TrutoProxy->>OneTrust: PUT /requestqueues/{id}/stage
    OneTrust-->>TrutoProxy: 200 OK (Stage Updated)
    TrutoProxy-->>Claude: JSON Tool Result
```

### Workflow 2: AI Governance & Risk Orchestration

When deploying a new LLM feature, security teams must document the model, assess it, and log risks.

> **User Prompt**: "Create a new AI Model entity in OneTrust called 'Customer Support Chatbot v2'. Once created, launch the standard AI Risk Assessment against it, and log a baseline risk for 'Prompt Injection Vulnerability'."

**Agent Execution Sequence:**
1.  **`create_a_one_trust_custom_entity_model`**: The agent creates the new AI model record in the Object Manager and retrieves the new Entity UUID.
2.  **`create_a_one_trust_assessment`**: Using the new Entity UUID, the agent launches the specific assessment template for AI models.
3.  **`create_a_one_trust_risk`**: The agent creates a risk record for prompt injection and associates it with the newly created AI model entity.

**Result**: A fully documented AI governance trail is created across three different OneTrust modules in seconds, simply by typing a sentence.

## Stop Building Boilerplate Integration Code

Building a custom integration for a massive, enterprise-grade GRC platform like OneTrust is a massive distraction from your core product. You have to handle OAuth lifecycles, parse undocumented rate limit headers, and map deeply nested JSON payloads just to get a single endpoint working.

Truto's MCP servers turn the entire OneTrust API surface area into AI-ready tools instantly. Truto manages the authentication, the schemas, and the API proxying, while you focus on building the actual AI agent logic.

> Stop writing boilerplate integration code. Let's talk about giving your AI agents secure, managed access to OneTrust and 100+ other enterprise APIs.
>
> [Talk to us](https://truto.one/book-a-demo/)