FAQs: Scrut MCP

Any Scrut user (admin, contributor, auditor) can connect Scrut MCP to their AI tool. Once connected, your AI assistant only sees what your existing Scrut role already lets you see. There are no separate MCP-specific permissions to configure.

Your new role applies automatically; No need to reconnect. Scrut MCP checks your user record and role on an ongoing basis, so a role change takes effect within a few minutes of being made in Scrut.

No. Scrut MCP acts in your own Scrut role with the same access you already have on the platform. It doesn't grant any broader access through your AI tool.

For example, if your Scrut role only gives you access to the Vendor Management module and no access to Access Reviews, your AI tool can only access data from the Vendor Management module and won't be able to see or act on Access Reviews data either, no matter what you ask it to do.

Scrut MCP requests will fail if your Scrut account is deactivated. A deactivated user can't use Scrut MCP, just as they can't sign in to the Scrut platform.

No. Each person connects with their own Scrut login, and there's no cap on how many users in your organization can be connected or active at the same time.

There's no fixed logout timeframe. Scrut MCP uses short-lived access tokens that your AI tool refreshes silently in the background, so you stay connected without re-entering credentials. You remain connected until you disconnect Scrut MCP from your AI tool, your sign-in grant expires or is revoked, or your Scrut account is deactivated. If this happens, the tool will prompt you to sign in again.

Yes. Each AI tool gets its own independent sign-in, so you can be connected to Claude, Cursor, and others simultaneously. Disconnecting one doesn't affect the others, and none of them affect your Scrut web session.

Scrut MCP connects to Claude, Cursor, Codex, ChatGPT, or any other AI tool that supports MCP or custom connectors.

Yes, as long as the application running the local model (e.g., Llama via Ollama) supports remote MCP servers with OAuth sign-in. However, response quality depends on the model’s tool-calling ability, so results may differ with smaller local models.

Yes. Use the document content tool to pull the full text of one specific policy or evidence document when you need to quote or verify it.

No. Scrut MCP can upload files and attach evidence, but it can't delete or overwrite anything that already exists in your compliance program.

Yes. Scrut MCP provides a faster starting point for questionnaire responses, evidence filing, and status updates. It doesn't remove human review from evidence decisions or audit responses.

No rate limits are enforced today, and you don't need to space out your prompts.

It depends on the access already given to you on Scrut. If your Scrut role includes cloud test remediation, Scrut MCP can use that same access to reach the infrastructure-as-code to suggest a fix. If your role doesn't include it, your AI tool won't have that access either, regardless of what you ask it to do. Tasks like asking questions, drafting questionnaire answers, and filing evidence don't need cloud or codebase access to begin with.

No. Scrut remains your system of record for your compliance program. Scrut MCP brings that context into the AI tools you already work in; it doesn't move your compliance program anywhere else.

Yes. It is available for all plans (Foundation, Growth, and Scale)

You can do it on your own. For step-by-step instructions, see here.