Connect SecurityScorecard to ChatGPT: Track Risk & Portfolios

If you need to connect SecurityScorecard to ChatGPT to automate third-party risk management, track vendor portfolios, or orchestrate cybersecurity audits, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's JSON-RPC tool calls and SecurityScorecard's REST APIs. You can either build and maintain this integration layer yourself, or use a managed infrastructure platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting SecurityScorecard to Claude or explore our broader architectural overview on connecting SecurityScorecard to AI Agents.

Giving a Large Language Model (LLM) read and write access to a complex risk management platform like SecurityScorecard is a massive engineering challenge. You have to handle complex portfolio identifiers, manage asynchronous report generation, and navigate point-in-time historical event logs. Every time the upstream API changes its schema or rate limits shift, your custom server code must be updated, redeployed, and tested.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for SecurityScorecard, connect it natively to ChatGPT, and execute complex compliance workflows using natural language.

Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. :::

The Engineering Reality of the SecurityScorecard API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, implementing it against SecurityScorecard's specific API surface is exceptionally painful.

If you decide to build a custom MCP server for SecurityScorecard, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with this platform:

Scorecard Identifiers and Portfolio Dependencies

Unlike standard SaaS platforms where you can query any user or record by ID, accessing detailed factor-level data and issue logs in SecurityScorecard often requires that the target company first be added to a portfolio. If your LLM attempts to call an endpoint like list_all_security_scorecard_companie_factors for a random domain, it will fail unless that domain is already actively tracked in the account's portfolio. Your MCP server or your LLM system prompt must understand this dependency chain: check if the domain is tracked, add it if not, retrieve the scorecard_identifier, and only then query the deep analytics.

Time-Series Event Logs via Effective Dates

SecurityScorecard does not just maintain a static list of vulnerabilities. Its issue tracking operates as a time-series event log. To see adware installations or exposed ports, the API requires an effective_date parameter. The data acts as a historical snapshot (available for the last 12 months). Building static MCP schemas for this means instructing the LLM that it cannot simply ask "What are the active issues?" - it must formulate queries using specific ISO datetimes to reconstruct the timeline of a company's security posture.

Asynchronous Report Generation

Enterprise risk platforms generate massive reports. When calling endpoints like create_a_security_scorecard_reports_detailed, the API does not return the report data. It returns a report_url and a status (e.g., processing). Your LLM must be equipped with the logic to interpret this asynchronous response, wait, and use a separate tool call to download the completed file once the status updates. Handling async state machines via LLM tool calling is notoriously difficult if the MCP tool descriptions aren't perfectly tuned.

Rate Limits and Error Handling

SecurityScorecard enforces strict rate limits, particularly on heavy operations like asynchronous reporting and bulk company searches. Factual note on rate limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream SecurityScorecard API returns an HTTP 429 Too Many Requests, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (your AI agent framework or ChatGPT client) is entirely responsible for implementing retry and backoff logic. Do not expect the MCP server to absorb these errors.

SecurityScorecard to ChatGPT Quickstart Guide

If you just want the fastest path from a fresh Truto account to ChatGPT calling the SecurityScorecard API, follow these steps.

Step 1: Connect the Integrated Account

First, you need to establish the OAuth or API key connection to SecurityScorecard.

1. Log into your Truto dashboard.
2. Navigate to Integrated Accounts -> New Integrated Account.
3. Select SecurityScorecard and complete the authentication flow.
4. Note the resulting integrated_account_id.

Step 2: Create the MCP Server

Truto scopes MCP servers to specific integrated accounts. You can create the server via the UI or the API.

Option A: Via the Truto UI

1. Navigate to the integrated account page for your SecurityScorecard connection.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (e.g., allow read and write methods, restrict to specific tags like portfolios).
5. Copy the generated MCP server URL.

Option B: Via the API You can dynamically provision servers in your code. This is useful for multi-tenant applications.

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ChatGPT Risk Auditor",
    "config": {
      "methods": ["read", "write"],
      "tags": ["portfolios", "scorecards"]
    }
  }'

The API returns a secure url (e.g., https://api.truto.one/mcp/<token>). Treat this URL as a secret, as it contains the cryptographic token required for access.

Step 3: Connect to ChatGPT

Now, feed this URL to your ChatGPT environment.

Option A: Via the ChatGPT UI (For Plus/Pro/Enterprise Users)

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Ensure Developer mode is toggled on.
3. Click Add under the MCP servers or Custom connectors section.
4. Name the connector (e.g., "SecurityScorecard by Truto").
5. Paste your Truto MCP URL into the Server URL field and save.

Option B: Via Manual Config File (SSE Transport) If you are running a local MCP proxy or testing with an environment that requires a standard config file (like Claude Desktop or Cursor, which share the same JSON config structure), you can bridge the HTTP SSE connection using the official MCP SDK CLI.

{
  "mcpServers": {
    "securityscorecard": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/<your-token-here>"
      ]
    }
  }
}

ChatGPT will immediately ping the /initialize endpoint, discover the tools, and they will be ready for natural language invocation.

SecurityScorecard Hero Tools

Truto automatically generates MCP tools based on the SecurityScorecard API documentation. Here are the highest-leverage tools available for your AI agents. For the complete list of available operations and schema details, see the SecurityScorecard integration page.

1. List Portfolio Companies

Tool name: list_all_security_scorecard_portfolio_companies_v_2

Retrieves the domains currently tracked within a specific portfolio. This is the foundational query for any risk assessment workflow, as you need to know which companies are actively monitored before diving into their specific vulnerabilities.

"Get all the companies currently tracked in my 'Critical Vendors' portfolio (ID: 12345). Filter the list to only show companies with a grade of C or lower."

2. View Scorecard History Events

Tool name: list_all_security_scorecard_history_events

Retrieves the event log entries for a company in SecurityScorecard over the last 12 months. This acts as a news feed for a scorecard, showing exactly when new issues were discovered, when they were resolved, and when breaches were reported.

"Pull the scorecard event history for 'example.com' over the last 30 days. Highlight any events related to newly discovered high-severity vulnerabilities."

3. Add Company to Portfolio

Tool name: security_scorecard_portfolio_companies_bulk_update

Adds a new company scorecard to a specific portfolio by domain. Because detailed factor-level data requires a company to be in a portfolio, this tool is the necessary prerequisite when an agent is investigating a new vendor.

"Add 'newvendor.io' to my 'Software Supply Chain' portfolio so we can begin tracking their security grade."

4. Fetch Company Summary

Tool name: list_all_security_scorecard_companies

Retrieves the high-level summary of a company's scorecard, including their overall grade, numerical score, and industry classification. This requires the scorecard_identifier.

"Get the current scorecard summary for 'supplier-domain.com'. I need their overall grade and their current industry benchmark score."

5. Generate Detailed Async Reports

Tool name: create_a_security_scorecard_reports_detailed

Initiates the asynchronous generation of a detailed SecurityScorecard report. Because these reports are heavy, the tool returns a URL and a processing status. The LLM must be prompted to handle the delay.

"Generate a detailed security report for our primary cloud hosting vendor. Keep checking the status URL until it says 'completed', then provide me the link to download the PDF."

6. Track Expanded Risks

Tool name: list_all_security_scorecard_portfolio_expanded_risks

Lists expanded risk entries for all companies within a specific portfolio. This is highly effective for cross-portfolio auditing, allowing an agent to surface widespread risks across your entire supply chain in a single call.

"Scan my entire 'Partner Ecosystem' portfolio and list all the expanded risks. Group the results by industry and tell me which sector has the highest risk concentration."

For the complete inventory of tools, including endpoint schemas, parameter definitions, and custom resource mappings, visit the SecurityScorecard integration page.

Workflows in Action

AI agents excel at orchestrating multi-step API processes that normally require a human to click through dozens of dashboard pages. Here are two real-world workflows you can execute with ChatGPT connected to SecurityScorecard.

Workflow 1: New Vendor Risk Onboarding

Persona: IT Security Administrator

When a new vendor is proposed, security teams need to immediately assess their posture. Doing this manually involves navigating to the platform, adding the domain, waiting for a score, and pulling a summary report.

"A new vendor, 'acme-corp.com', is being evaluated. Add them to the 'Under Evaluation' portfolio, retrieve their scorecard summary, and tell me if their grade is below a B. If it is, list the top three vulnerability events from their history over the last 3 months."

Agent Execution Steps:

1. Calls security_scorecard_portfolio_companies_bulk_update with the portfolio ID and domain: "acme-corp.com".
2. Calls list_all_security_scorecard_companies using the scorecard_identifier to get the current grade.
3. Evaluates the JSON response. If the grade is C, D, or F, it proceeds to step 4.
4. Calls list_all_security_scorecard_history_events with the relevant effective_date ranges to isolate the most recent negative events.

Result: The user gets a plain-text summary of the vendor's risk profile and immediate actionable intelligence on why their score is degraded, without ever opening the SecurityScorecard dashboard.

Workflow 2: Monthly Supply Chain Compliance Audit

Persona: GRC / Compliance Analyst

Compliance teams must regularly audit their critical vendors and maintain records of security posture.

"Run our monthly audit on the 'Tier 1 Infrastructure' portfolio. First, get a list of all companies in this portfolio. Then, for any company that has an active 'malware_infection' issue in their recent event history, generate a detailed report. Finally, output a summary table of the companies requiring immediate remediation."

sequenceDiagram
    participant User as User
    participant GPT as ChatGPT
    participant MCP as Truto MCP Server
    participant Upstream as "Upstream API (SecurityScorecard)"

    User->>GPT: "Run monthly audit on Tier 1 portfolio..."
    GPT->>MCP: Call list_all_security_scorecard_portfolio_companies_v_2(portfolio_id: "T1-123")
    MCP->>Upstream: GET /portfolios/T1-123/companies
    Upstream-->>MCP: [Company List JSON]
    MCP-->>GPT: [Company List Array]
    
    loop For each company
        GPT->>MCP: Call list_all_security_scorecard_history_events(scorecard_identifier)
        MCP->>Upstream: GET /scorecards/{id}/history/events
        Upstream-->>MCP: [Event Log JSON]
        MCP-->>GPT: [Event Log Array]
        
        opt Has Malware Infection
            GPT->>MCP: Call create_a_security_scorecard_reports_detailed(scorecard_identifier)
            MCP->>Upstream: POST /reports/detailed
            Upstream-->>MCP: { report_url: "...", status: "processing" }
            MCP-->>GPT: Async Report Status
        end
    end
    
    GPT-->>User: Markdown summary table of vulnerable vendors and report links.

Result: The agent orchestrates a complex O(n) fan-out query. It retrieves the portfolio, loops through the companies to check their event histories, conditionally triggers asynchronous report generation for failing vendors, and formats the output into a consumable management summary.

Security and Access Control

Exposing an enterprise risk platform to an AI model requires strict governance. Truto provides several mechanisms to control exactly what the MCP server can execute:

• Method Filtering: When creating the server via the API or UI, you can restrict it to specific operation types. Set methods: ["read"] to ensure ChatGPT can only run get and list queries, completely preventing it from accidentally deleting portfolios or altering tags.
• Tag Filtering: You can constrain the server's surface area by providing an array of tags (e.g., tags: ["portfolios", "reports"]). The MCP server will only generate and expose tools that belong to those specific integration resource groups.
• Extra Authentication (require_api_token_auth): By default, possessing the MCP URL is enough to connect. For high-security environments, setting this flag to true requires the connecting client to also pass a valid Truto API token in the Authorization header.
• Time-to-Live (expires_at): You can set an automatic expiration datetime. Once the timestamp passes, the underlying distributed key-value store automatically purges the token, and the URL instantly becomes invalid - perfect for granting temporary AI agent access during an audit sprint.

Scale Your Cybersecurity Automation

Connecting SecurityScorecard to ChatGPT completely alters how security operations and GRC teams manage third-party risk. Instead of writing custom Python scripts to parse paginated event logs and poll async reporting endpoints, you can deploy a managed MCP server in seconds and let the LLM handle the orchestration.

With Truto handling the token refresh lifecycles, translating complex OpenAPI specs into JSON-RPC tool definitions, and standardizing IETF rate limit headers, your engineering team can focus on building advanced AI agent workflows rather than maintaining API plumbing.

Stop building fragile custom connectors. Spin up a secure, scoped MCP server for SecurityScorecard today and give your AI agents the tools they need to secure your supply chain.