Connect SecurityScorecard to Claude: Audit Trends & Compliance

If you need to connect SecurityScorecard to Claude to automate vendor risk assessments, triage compliance issues, or monitor external attack surfaces, you need a Model Context Protocol (MCP) server. This server acts as the critical translation layer between Claude's natural language tool calls and SecurityScorecard's highly structured REST APIs. You can either build and maintain this translation layer yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL in seconds.

If your team uses ChatGPT, check out our guide on connecting SecurityScorecard to ChatGPT or explore our broader architectural overview on connecting SecurityScorecard to AI Agents.

Giving a Large Language Model (LLM) read and write access to a specialized vendor risk management (VRM) platform is an engineering challenge. You must handle complex pagination, manage API token lifecycles, map massive nested JSON schemas to MCP tool definitions, and deal with SecurityScorecard's strict domain logic. Every time an endpoint is updated or a new vulnerability factor is introduced, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for SecurityScorecard, connect it natively to Claude Desktop, and execute complex security auditing workflows using natural language.

The Engineering Reality of the SecurityScorecard API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against specialized B2B APIs is painful. SecurityScorecard is built to manage deep technical vulnerability data, complex organizational hierarchies, and continuous compliance monitoring. Its API reflects that complexity.

If you decide to build a custom SecurityScorecard MCP server, here are the specific integration challenges you will face:

The Portfolio Prerequisite Architecture Unlike generic CRM APIs where you can query any record by ID, SecurityScorecard enforces strict relationship constraints. To access deep factor-level data, expanded risks, or historical events for a specific company, that company must first be added to an active Portfolio under your account. An LLM cannot simply guess this architectural requirement. If it tries to fetch list_all_security_scorecard_companie_factors for a domain not in a portfolio, it will hit a hard error. Your MCP tool descriptions must explicitly guide the AI to check portfolio inclusion and add the domain if missing before querying deeper vulnerability metrics.

Asynchronous Report Generation Polling Generating compliance and executive reports in SecurityScorecard is an asynchronous process. Endpoints like create_a_security_scorecard_reports_summary do not return the report data immediately. Instead, they return a status and a report_url. Your agent must be instructed to initiate the generation, capture the URL, and poll it later. LLMs are notoriously bad at asynchronous waiting. You must design your MCP tools to handle this stateful interaction cleanly, teaching the model to step away and verify the status rather than hanging indefinitely on a single tool call.

Event-Log Pagination and Temporal Constraints SecurityScorecard tracks historical score changes and breaches through event logs, but this data is strictly constrained. Historical score data is typically only available for a rolling 12-month window. Furthermore, finding specific issues requires querying by an effective_date. When building custom tools, you have to ensure the AI passes valid, formatted ISO-8601 dates and understands the temporal limitations of the data it is querying. If the LLM hallucinates a date from three years ago, the API will reject the request.

Rate Limits and 429 Handling It is a factual reality of API integrations that you will hit rate limits. Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream SecurityScorecard API returns an HTTP 429 Too Many Requests error, Truto passes that exact error directly back to the caller. However, Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (your custom agent framework or the Claude client) is strictly responsible for implementing retry logic and exponential backoff based on these headers.

Creating the SecurityScorecard MCP Server

Instead of dealing with these edge cases manually, Truto allows you to generate a fully managed MCP server endpoint. Truto derives the available tools directly from the SecurityScorecard API documentation, meaning they are always up to date with the underlying schemas.

There are two ways to spin up your MCP server: via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

For administrators who want a visual setup process, the Truto dashboard provides a point-and-click interface to generate your MCP server URL.

1. Log into your Truto account and connect a SecurityScorecard instance via the Integrations page.
2. Navigate to the Integrated Accounts page for your specific SecurityScorecard connection.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration. You can filter the tools to only allow read methods, or restrict access using tags (e.g., exposing only reporting or portfolio tools).
6. Click Create and copy the generated MCP server URL (it will look like https://api.truto.one/mcp/abc123xyz...).

Method 2: Via the Truto API

For engineering teams building automated provisioning pipelines, you can generate the MCP server programmatically. This is ideal when spinning up AI agents dynamically for different tenants or internal users.

Make a POST request to /integrated-account/:id/mcp with your desired configuration payload.

curl -X POST "https://api.truto.one/admin/integrated-accounts/{integrated_account_id}/mcp" \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Claude Vendor Risk Auditor",
    "config": {
      "methods": ["read", "write"],
      "tags": ["core", "issues", "reporting"]
    },
    "expires_at": null
  }'

The API will return a JSON object containing the secure MCP URL. This URL contains a hashed cryptographic token that scopes all requests to this specific SecurityScorecard environment.

{
  "id": "mcp_srv_890xyz",
  "name": "Claude Vendor Risk Auditor",
  "url": "https://api.truto.one/mcp/d7f8g9h0j1k2l3..."
}

Connecting the MCP Server to Claude

Now that you have your secure MCP URL, you need to register it with Claude. Depending on whether you are using the consumer-facing Claude application or building a custom agent with the Anthropic SDK, the connection method differs slightly.

Method A: Via the Claude UI (Desktop/Web)

If you are using Claude Desktop or Claude Web (on supported plans), adding the server is a matter of pasting the URL into the settings menu.

1. Open Claude Desktop or the web interface.
2. Navigate to Settings -> Integrations -> Add MCP Server (or Settings -> Connectors -> Add depending on your version).
3. Paste the Truto MCP URL (https://api.truto.one/mcp/...) into the Server URL field.
4. Click Add or Save.

Claude will perform a handshake with the Truto server, execute a tools/list request, and immediately populate its context window with the available SecurityScorecard operations.

Method B: Via the Configuration File

For teams managing Claude Desktop environments programmatically or using custom local agents, you can mount the server using the standard JSON configuration file.

Because Truto exposes the server over HTTP SSE (Server-Sent Events), you utilize the official @modelcontextprotocol/server-sse package as the transport layer command.

Locate your claude_desktop_config.json file (typically found at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS) and add the following block:

{
  "mcpServers": {
    "securityscorecard": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/d7f8g9h0j1k2l3..."
      ]
    }
  }
}

Restart Claude. The model will parse the configuration, establish the SSE connection, and ingest the SecurityScorecard schemas dynamically.

SecurityScorecard Hero Tools

Truto exposes the entirety of the SecurityScorecard API to your LLM framework. However, certain tools are fundamental to extracting value from the platform. Here are the highest-leverage tools available in your managed MCP server.

Get Company Scorecard Summary

Tool: list_all_security_scorecard_companies

This is the starting point for any vendor assessment. It retrieves the top-level scorecard summary for a given domain, returning the overall grade, numerical score, and industry benchmarking data.

Contextual Note: You must provide the scorecard_identifier (typically the domain name). Ensure the company is in your portfolio first if you intend to drill down into factors later.

"Fetch the scorecard summary for example.com. What is their current overall grade and numerical score?"

List Companies in a Portfolio

Tool: list_all_security_scorecard_portfolio_companies_v_2

To audit an entire category of vendors (e.g., "Cloud Infrastructure Providers"), you need to retrieve all companies grouped within a specific portfolio. This tool returns the domains, grades, and statuses of all monitored entities in that list.

Contextual Note: This requires the portfolio_id. You can combine this with list_all_security_scorecard_portfolios to find the correct ID first.

"List all companies in the 'Critical Infrastructure' portfolio. Filter for any companies that currently have a grade of C or lower."

List High-Severity Patching Cadence Issues

Tool: list_all_security_scorecard_issues_patching_cadence_v_3_highs

Patching cadence is a massive indicator of organizational security hygiene. This tool digs into the specific high-severity patching issues affecting a domain on a given date.

Contextual Note: You must supply the scorecard_identifier and a specific effective_date to query the event log.

"Check the patching cadence for vendor-domain.com for yesterday's date. Are there any high-severity unpatched CVEs listed?"

List Breach Events

Tool: list_all_security_scorecard_events_breaches

When evaluating risk, historical breaches are a primary signal. This tool queries the event log specifically for reported breach events tied to a domain, returning the date and description of the incident.

Contextual Note: This provides a chronological feed of negative events. It is vital for continuous monitoring workflows.

"Retrieve the breach events history for supplier.io. Have they experienced any confirmed data leaks in the past 12 months?"

List Factor Scores and Issue Counts

Tool: list_all_security_scorecard_companie_factors

The top-level score is an aggregate. To understand why a vendor has a bad grade, you must analyze the underlying factors (e.g., Network Security, DNS Health, Endpoint Security). This tool breaks down the score category by category.

Contextual Note: The target domain must exist in one of your portfolios to access this deeper factor-level data.

"Break down the factor scores for partner-tech.com. Which specific category has the highest number of open issues?"

Generate Company Summary Report

Tool: create_a_security_scorecard_reports_summary

For executive briefings or compliance documentation, you need structured PDF or CSV reports. This tool triggers the asynchronous generation of a comprehensive company summary.

Contextual Note: This tool initiates a background job. The AI will receive a report_url and status indicating it is processing. The AI must be instructed to wait or inform the user that the report is generating.

"Generate a company summary report for logistics-corp.com. Provide me with the download URL and the current processing status."

To view the complete inventory of available tools, query parameters, and JSON schemas, visit the SecurityScorecard integration page.

Workflows in Action

With the MCP server connected, Claude can now chain these tools together to execute complex, multi-step security operations. Here are two real-world scenarios demonstrating how AI agents navigate the SecurityScorecard architecture.

Scenario 1: Vendor Risk Onboarding & Triage

When a new vendor is proposed, IT Security administrators need an immediate risk profile before approving access to corporate data. Claude can perform this triage autonomously.

"We are evaluating 'acme-vendor.com' for a new software contract. Please fetch their top-level scorecard. If their grade is below a 'B', break down their factor scores to tell me which area is dragging them down. Finally, check if they have any reported breach events in their history log."

How the agent executes this:

1. Calls list_all_security_scorecard_companies with the scorecard_identifier set to acme-vendor.com to get the top-level grade.
2. Assuming the grade is a 'C', Claude recognizes the conditional trigger and calls list_all_security_scorecard_companie_factors to get the category breakdown.
3. Claude identifies that 'Network Security' has a severe issue count.
4. Claude calls list_all_security_scorecard_events_breaches to check the historical event log for that domain.
5. The agent synthesizes this raw API JSON into a clean, readable risk summary for the administrator, highlighting the specific network vulnerabilities and past breaches.

sequenceDiagram
    participant User as IT Admin
    participant Claude as Claude Desktop
    participant Truto as Truto MCP Server
    participant SSC as SecurityScorecard API

    User->>Claude: Evaluate acme-vendor.com
    Claude->>Truto: list_all_security_scorecard_companies(acme-vendor.com)
    Truto->>SSC: GET /companies/acme-vendor.com
    SSC-->>Truto: Returns Grade C
    Truto-->>Claude: JSON data
    Claude->>Truto: list_all_security_scorecard_companie_factors(...)
    Truto->>SSC: GET /companies/acme-vendor.com/factors
    SSC-->>Truto: Network Security low score
    Truto-->>Claude: JSON data
    Claude-->>User: Delivers Vendor Risk Triage Report

Scenario 2: Automated Compliance Reporting

GRC analysts spend hours compiling risk reports for critical vendors. Claude can automate the extraction of this data across an entire portfolio.

"List all the companies in our 'Tier 1 Suppliers' portfolio. Find any companies that have a grade of C or lower. For those at-risk companies, trigger a detailed company summary report generation so we can send it to the risk committee."

How the agent executes this:

1. Calls list_all_security_scorecard_portfolios to find the internal ID matching "Tier 1 Suppliers".
2. Calls list_all_security_scorecard_portfolio_companies_v_2 using the retrieved portfolio ID, fetching the list of domains.
3. Claude parses the returned array, filtering out companies with 'A' or 'B' grades.
4. For each remaining at-risk domain, Claude iterates and calls create_a_security_scorecard_reports_summary to initiate the asynchronous PDF generation.
5. Claude outputs a list of the at-risk vendors alongside the pending report_url links for the analyst to download once processing finishes.

Security and Access Control

When granting AI agents access to sensitive compliance and vulnerability data, strict access control is mandatory. Truto provides several mechanisms to lock down your MCP servers:

• Method Filtering: You can restrict a server to safe operations by setting config.methods: ["read"]. This ensures Claude can query scores and logs but cannot accidentally delete a portfolio or mutate tag configurations.
• Tag Filtering: You can scope servers to specific functional areas using config.tags. If you only want an agent to access reporting tools, you can filter out all footprinting or custom scorecard manipulation endpoints.
• Extra Authentication: By enabling require_api_token_auth, possession of the MCP URL is no longer enough. The client (e.g., your custom agent backend) must also pass a valid Truto API token in the Authorization header to invoke the tools.
• Ephemeral Servers: You can define an expires_at timestamp when creating the server. Once the time passes, Truto automatically destroys the token and the server ceases to function, making it ideal for temporary contractor access or one-off audit scripts.
• Rate Limit Passthrough: Truto enforces a transparent proxy architecture. It does not absorb rate limits or obscure headers. You maintain full visibility into SecurityScorecard's ratelimit-remaining headers, ensuring your agent frameworks can back off gracefully without getting blacklisted.

Strategic Wrap-up

Building AI agents that can autonomously navigate the complexities of vendor risk management requires robust, standardized API access. The SecurityScorecard API is powerful but highly structured, requiring specific portfolio associations, strict date formatting, and an understanding of asynchronous reporting.

By utilizing Truto to generate a managed MCP server, you offload the burden of schema mapping, pagination handling, and protocol translation. Your engineering team avoids writing and maintaining hundreds of lines of brittle integration code. Instead, your LLMs interact with a clean, dynamic set of tools derived directly from the source truth of the API, allowing your security teams to focus on mitigating risk rather than fighting infrastructure.