Menu

    Setting up SCW’s MCP Server

    Avatar
    Secure Code Warrior Elves
    • Updated
    Follow

    Talk to your Secure Code Warrior data. The SCW MCP server connects Claude, Cursor, ChatGPT, and OpenClaw.

    Most AppSec and engineering leaders know this drill: someone asks "how's our risk posture looking this quarter," and the answer means logging into the portal, exporting a report, and stitching it into something presentable, by which point someone's already asking the follow-up question.

    The SCW MCP server removes that step. Connect it once, and Claude, Cursor, ChatGPT, or OpenClaw can query your live Trust Score and learning data in plain language.

    In short, the SCW MCP server gives MCP-compatible AI assistants direct, real-time access to your SCW reporting data, Trust Score, learning, and Quest activity starting today. Setup is a one-time OAuth authorization, with no API keys to manage and no admin ticket required. This is also just the first release in a wider agentic layer for the SCW platform, with broader platform actions to follow as the server matures.

     

     

    What MCP actually does

     

    Model Context Protocol (MCP) is an open standard that gives AI assistants a consistent way to discover and call into external tools, instead of every vendor building a bespoke integration for every AI client.

    Think of it less like a plug and more like a shared language: once your assistant and SCW's server both speak MCP, they can hold a conversation about your data without a developer wiring anything together in between.

    The SCW MCP server is a hosted MCP server available at two regional endpoints:

    Region Server URL
    US https://portal-api.securecodewarrior.com/mcp
    EU https://portal-api.eu.securecodewarrior.com/mcp

    Connect to whichever endpoint matches where your organization's SCW instance is hosted. If you're not sure, ask your Customer Success Manager (CSM), the two endpoints serve entirely separate data stores, so pointing at the wrong one will simply fail to authenticate rather than surface the wrong org's numbers.

    Once authorized, your assistant can query SCW in real time, and in whatever form you ask for it.

    Why this matters for AppSec teams specifically

    Your governance signal, without the export step

    SCW already tracks the data that AppSec and engineering leadership actually get graded on: Trust Score by team and individual, learning and Quest completion, vulnerability trends tied back to specific contributors and repos. The MCP server doesn't summarize that down to a CSV, it hands your assistant the underlying structure, so it can slice by team, timeframe, or risk category on request.

    No new tooling to roll out

    There's nothing to procure and no new license to negotiate. If you already have an SCW account and an MCP-capable assistant, you can connect today.

    Quest management coming soon

    This first release covers reporting. Quest management and administration are next on the roadmap, with more of the platform becoming available through the MCP server over time.

     

    What the connection can and can't do

     

    Handing an AI assistant access to your security and governance data is worth being careful about. Here's what's actually in place:

    • Authorization runs through OAuth, SCW never shares your password or a standing API key with the AI client itself.
    • Today's release is reporting-only: your assistant can read and analyze the same data available on your dashboards. It cannot change training assignments, edit policies, or alter workspace configuration.

    • The US and EU endpoints are fully separate, connecting to one keeps your queries scoped to that region's data only.

       

    Session duration

     

    The MCP server follows strict session timeout rules depending on how users authenticate:

    • Default session duration: Standard sessions remain active for 1 hour.
    • Extended sessions: Selecting "Remember me" extends the session duration up to 24 hours.
    • Single Sign-On (SSO): SSO sessions are capped at strictly 1 hour to meet Enterprise security requirements.

    While these short session lifetimes work well for interactive, real-time chats, they present challenges for long-running, scheduled, or agentic workflows. Future authentication solutions and persistent token mechanism options are currently being explored to support background processing.

     

    Setting up the connection

     

    Each of these setups takes a few minutes. Authorization runs through OAuth end to end, so there's no token to copy, paste, or rotate manually.

     

    Claude (Claude Desktop)

    1. Open Settings → Connectors.
    2. Add your region's server URL: 
      https://portal-api.securecodewarrior.com/mcp (US) or 
      https://portal-api.eu.securecodewarrior.com/mcp (EU).
    3. Complete the OAuth consent screen.
    4. The SCW tool now shows up in Claude's available tools.

    Cursor

    1. Open Settings → MCP servers.
    2. Add your region's server URL.
    3. Authorize in the browser tab that opens.
    4. Back in Cursor, the SCW tool is ready to use.

    ChatGPT

    ChatGPT requires developer mode before it can reach any custom MCP server, including SCW's.

    Turn on developer mode first:

    1. In ChatGPT, go to Settings → Apps → Advanced settings.
    2. Enable Developer mode.

    Then create the connector:

    1. Go to Settings → Apps → Create app.
    2. Name it "Secure Code Warrior," give it a short description (for example, "Query SCW Trust Score, learning, and vulnerability reporting and quest management (soon!)"), and set the connection URL to your region's endpoint.
    3. Click Create, then finish the OAuth sign-in and approval.
    4. Click Allow.

    To use it in a chat, click the + next to the message box, choose More, and select the Secure Code Warrior connector.

    OpenClaw (and other self-hosted or single-user setups)

    1. Open OpenClaw's MCP or integrations settings.
    2. Add a new server connection using your region's SCW endpoint.
    3. Sign in to SCW when prompted.
    4. Review the permissions requested and approve.
    5. Test it with something like "Which teams have the highest open vulnerability count right now?"

    Questions worth asking once you're connected

    The value shows up the moment you stop building slides and start asking directly.

    • "Which engineering teams have the weakest Trust Score trend over the last two quarters?"
    • "Show me my team's Quest completion rate compared to the org average."
    • "How's engagement trending across our learning programs this month?"

    • "Create a PCI DSS quest and assign it to the whole company. Save as draft and I'll review it on the platform before publishing."

       

    FAQ

     

    What is the SCW MCP server? An MCP endpoint that lets AI assistants, Claude, Cursor, ChatGPT, and others query your live Secure Code Warrior reporting data in natural language, instead of you exporting it manually.

    How do I connect Claude to it? In Claude Desktop: Settings → Connectors → add your regional server URL → complete the OAuth consent flow.

    Does it work with Cursor and ChatGPT? Yes, any MCP-compatible client works, including Cursor, ChatGPT (once developer mode is enabled), and OpenClaw.

    Should I connect to the US or EU server? Whichever matches where your SCW instance is hosted. Confirm with your Customer Success Manager (CSM) if you're not certain.

    Is this secure? Authorization is OAuth-based, every connection requires explicit consent, and access can be revoked anytime. The current release only exposes reporting data.

    Do I need a new license or admin approval to use it? No new license or seat is required. If you have an SCW account and an MCP-capable assistant, you can connect directly.

    Can the assistant change anything in my SCW environment? Not currently. This release is limited to reporting queries, it can't modify training assignments, policies, or configuration.

    Comments

    0 comments

    Article is closed for comments.