Scrut MCP Tools
Explore the supported Scrut MCP tools and learn what each one does.
Who can use this feature
- Supported on Foundation, Growth, and Scale plans
How These Tools Work
You don't need to name a specific tool in your prompts. Describe what you're trying to do, and your AI assistant automatically selects the right tool, or combination of tools. For example, asking for a compliance digest might call the frameworks, controls, evidence, and test tools together in a single response.
Tool names and capabilities may change. If your AI assistant still shows older tool names, refresh the connector or reconnect Scrut MCP.
Read Tools
Scrut MCP currently offers the following read tools, grouped by what they help you do.
Workspace and Entity
Use these tools to confirm which workspace and entity your assistant is working in. If you have access to more than one workspace or entity, ask your assistant to list them first, then work on the one you want.
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_list_workspaces | Lists every Scrut workspace you can access, with its name and ID. | Which Scrut workspaces do I have access to? |
scrut_get_active_workspace | Shows which workspace is in use for the current request. It doesn't switch workspaces. | Which workspace am I in right now? |
scrut_list_entities | Lists every entity (product or business unit) you can access in the workspace. | Which entities are in this workspace? |
scrut_get_active_entity | Shows which entity filter is in use for the current request. It doesn't switch entities. | Which entity are these results filtered to? |
Frameworks and Controls
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_list_frameworks | Lists the frameworks enabled for your workspace, with progress, entities, and last and next audit dates. | What frameworks do we have enabled, and when is each one's next audit? |
scrut_list_controls | Lists controls with code, domain, assignees, status, and compliance percentage. You can filter results by framework, entity, scope, status, domain, function grouping, or assignee. | Which SOC 2 controls are non-compliant, and who owns them? |
scrut_get_control_by_id | Retrieves one control, including its mapped artifacts, requirements, and risks. | Which requirements and risks map to [Control Code]? |
Policies
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_list_policies | Lists policies with status, department, assignees, approvers, and next review date. You can filter results by framework, entity, status, review date, assignee, approver, department, or relevance. | Show me policies that are overdue for review. |
scrut_get_policy_by_id | Retrieves one policy, including assignees, approvals, revisions, mapped controls and requirements, linked tickets, and attachment IDs. | Who are the approvers on our Access Control Policy, and which controls does it map to? |
Evidence
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_list_evidence | Lists evidence tasks with status, department, assignees, approvers, and next review date. You can filter results by framework, entity, status, review date, assignee, approver, department, or relevance. | Which ISO 27001 evidence tasks are still Not Uploaded? |
scrut_get_evidence_by_id | Retrieves one evidence task, including its attachments and the periods they cover, mapped controls, tests, and monitors, and linked tickets. | Which controls and tests is [Evidence Name] mapped to? |
Tests
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_list_tests | Lists automated tests, including cloud tests, with status, application, and assignees. You can filter results by framework, entity, status, application, or assignee. | Which SOC 2 tests are failing, and which ones should I prioritize? |
scrut_get_test_by_id | Retrieves one automated or cloud test, including its flagged resources and remediation steps. Remediation is available as console steps, Terraform, AWS CLI, or CloudFormation. | Pull the details for [Test Name] and give me the Terraform fix. |
Trust Vault
Review the requests people submit to access your Trust Vault documents.
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_list_trust_vault_access_requests | Lists Trust Vault access requests, showing pending requests by default. You can filter results by status, request date, entity, document access (Full or Partial), or expiry, or search by the requester's name, email, or company. *Can return counts only*Shows requests across all entities unless you name one | How many access requests did we get this month, and how many are still pending? |
scrut_get_trust_vault_access_request_by_id | Retrieves one access request using the requester's ID (name, email, or company), along with details such as status, document access, expiry, approval, NDA details, and the documents requested or granted. Fields that don't apply to the request's current status (such as approval, NDA, expiry, decline) come back empty. | Show me the details of Jane Doe's request, including which documents she asked for. |
Documents and Answers
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_search_documents | Finds documents by name across Trust Vault, policies, and evidence. | Find our Vendor Risk Management policy. |
scrut_get_document_content | Returns a download link for a specific policy, evidence template, or attachment. It doesn't return the file's text. It can also return the signed NDA file attached to a Trust Vault access request. | *Get me a download link for our Password Management Policy.*Download the signed NDA for the AcmeCorp request. |
scrut_answer_question | Answers a security or compliance question from your policies, Trust Vault, and product documentation, and lists the sources it used. It tells you when it isn't confident instead of guessing. | Draft answers to this attached security questionnaire based on our compliance posture and cite each source. |
scrut_search_answer_library | Searches your answer library for previously approved questionnaire answers, so you can reuse a vetted answer. | Find our approved answer on vendor access reviews and reuse it as written. |
Heads Up! scrut_get_document_content returns a download link, not the document's text. Links for uploaded files expire after 1 hour and don't require a Scrut login. External links return the original link. Draft policies without a generated PDF return a note and no link.
Write Tools
Evidence
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_upload_evidence | Attaches a file or a link to an evidence task, with an optional note and evidence date. | Upload this file to [evidence_id] and include this note: attachment via MCP |
Uploading a file takes three steps, which your assistant runs for you:
- The assistant requests an upload link.
- The assistant uploads the file to that link.
- The assistant confirms the upload and attaches the file to the evidence task.
Attaching a link takes one step. You can upload any file type that Scrut supports for manual uploads. For the full list, see Supported File Types. Scrut records every upload in its audit log, just as it would for a human user.
Your AI assistant must be able to read the file and send it over the internet for file uploads to work. If it can't, attach a link instead or upload the file in Scrut.
Trust Vault Access Requests
Approve or decline access requests from your AI assistant. Each action updates the request in Scrut.
| Tool | What it does | Sample Prompt |
|---|---|---|
scrut_approve_trust_vault_access_request | Approves a pending request, or one previously declined, and emails the requester an access invitation. You choose the NDA type (No NDA, Clickwrap, or Signed outside Scrut) and when access expires (in 7, 15, or 30 days, on a specific date, or never). By default, the requester gets the access type and documents they asked for. You can give Full access or limit access to selected documents. | Approve the AcmeCorp request, but only for the SOC 2 report, until December 31. |
scrut_decline_trust_vault_access_request | Declines a pending request with a reason of up to 500 characters. The requester isn't emailed unless you ask your assistant to notify them. You can approve a declined request later. | Decline the request from johndoe@gmail.com and let him know to reapply with a work email. |
To approve a request with an NDA signed outside Scrut, your assistant must be able to read the NDA file and send it over the internet. The file is uploaded first, and the request is approved only after the upload succeeds.
Limitations
- Write actions are limited. Write actions are limited to attaching files and links to evidence, and approving or declining Trust Vault access requests. It can't delete, overwrite, or edit other content.
- Results of list tools are paginated. Each list tool returns up to 50 items at a time. Ask for more, and your assistant will fetch the next page.
- List tools apply default filters: in-scope controls, relevant policies and evidence, and Organization-wide tests. Ask for out-of-scope controls, not-relevant items, or a specific entity when you need them.
Tips for Better Outputs
- Name the framework or entity. Mention SOC 2, ISO 27001, or a specific product for focused results. A vague prompt may pull from every framework in your workspace.
- State your goal, not just the data you want. Tell your AI assistant what you're trying to accomplish, and it will select the right tools.
- Ask for sources. Scrut's answer tool always returns sources, but asking explicitly ensures your AI assistant includes them in its reply. This is especially helpful for questionnaire answers you plan to send externally.
- For questionnaires, check the answer library first. Previously approved answers are often the safest starting point.
- Review before you take action. MCP gives you a faster starting point, not a final answer. Check evidence decisions and questionnaire responses before you send them.
- Confirm before attaching. Ask your assistant to show what it's about to attach before it files evidence.
- Confirm before you approve or decline Trust Vault access requests. Ask your assistant to show the requester, access level, documents, NDA type, and expiry before it approves a Trust Vault request.
Contact support@scrut.io or your CSM for further assistance.