Who can use this feature
Supported on Foundation, Growth, and Scale plans
Scrut MCP Skills turn the Scrut MCP server into finished governance, risk, and compliance jobs you can trigger with a single prompt, like filing evidence, briefing leadership, answering a security questionnaire, or fixing a failing cloud test, from whatever AI coding tool you already use.
What are Scrut MCP Skills?
A Skill is a self-contained folder with a SKILL.md file inside it. When you ask your AI agent for a specific outcome, like "run my compliance digest," the agent loads the matching skill and runs the underlying Scrut MCP tools in the order the job needs. You get a named task with a reliable result, instead of a set of raw tools you have to sequence yourself.
Skills are client-agnostic. Once your AI tool is connected to Scrut MCP, the same skill works whether you're using Claude Code, Claude Desktop, Cursor, or another MCP-compatible tool.
Why Use Skills instead of Individual Tools?
Asking your AI assistant to complete a multi-step compliance task usually means describing every step yourself, in the right order, every time. A Skills package sequences once, so you get the same dependable outcome each time you ask for it, without re-explaining the steps in every conversation.
Available Skills
Note:
The Scrut MCP GRC Skills repo is public and actively growing. Check back for new skills as Scrut's team adds them.
scrut-upload-evidence: Uploads a file or attaches a link to the correct evidence item, with a note.
Sample prompt to trigger it: "File this access review as evidence."
scrut-compliance-digest: Summarizes your program's state, covering frameworks, controls, policies, evidence, and tests, in a format suited for leadership.
Sample prompt to trigger it: "Give me a compliance digest for the board."
scrut-answer-questionnaire: Drafts questionnaire answers from your documented posture, with citations, and flags any gaps it can't answer confidently.
Sample prompt to trigger it: "Answer this vendor security questionnaire."
scrut-fix-test: Finds a failing cloud test, pulls the remediation guidance, and helps you fix the underlying infrastructure-as-code.
Sample prompt to trigger it: "Fix our failing S3 public-access test."
Note: After you fix a failing test with this skill, verify the fix by re-running the test directly in Scrut. Re-running a test through MCP isn't available yet.
Built a Skill you're proud of? Add it to the collection.
Fork the Scrut MCP GRC Skills repo, add your skill, and open a pull request. The more teams contribute, the more useful Scrut MCP becomes for everyone.
Before You Begin
Skills call the tools exposed by the Scrut MCP server, so you need Scrut MCP connected to your AI tool first. See How to Connect Scrut MCP for setup steps. Once that connection is in place, skills work the same way regardless of which AI tool you're using.
Install a Scrut Skill in Claude
Claude Code or Claude Desktop
Copy the skill folder you want into your skills directory, for example, ~/.claude/skills/scrut-upload-evidence/.
Restart Claude Code or Claude Desktop.
Install a Scrut Skill in Any Agent
Point your agent (Cursor, Codex, ChatGPT, Microsoft Copilot, or similar) at the skills folder in the Scrut MCP GRC Skills repository, or copy the specific skill folder you want into your project.
Every SKILL.md is self-contained and readable by any agent. There's no build step and nothing to compile.
How Skills Stay Up to Date
Skill names stay stable over time. Each skill's version lives inside its SKILL.md file, with a changelog at the bottom describing what changed. The folder name never changes, so your existing installs and references keep working even as a skill's capabilities grow.
Note
Skills depend on the Scrut MCP tools available to your connection. If your connection is on an older version, a tool or skill it relies on may not appear yet. Skills are built to degrade gracefully. If a tool they need isn't available, they'll tell you instead of failing silently.
Reach out to support@scrut.io or contact your CSM for further assistance.