The SCW MCP Server lets Company Admins run their secure coding program from any MCP-compatible AI tool. Instead of building reports or setting up training manually, you ask in plain language: the AI tool drafts Quests and answers questions from your SCW reporting data. Answers come from the same reporting data as your SCW dashboards, which updates a few hours behind platform activity.
This article walks through good use cases to try, grouped by what you want to achieve. Each one includes a prompt you can copy, why the prompt is worded the way it is, and the steps to follow.
Article link: Not set up yet? Start with Setting up SCW's MCP Server.
In this article:
- Stay ahead of mandatory training
- Keep the curriculum aligned with current risk
- Show what your program is achieving
- Put your SCW data to work
Stay ahead of mandatory training
Track every team's progress
See every team's progress against a training requirement whenever you need it, so you know where to focus while there's still time to get every team across the line.
Prompt:
Using the SCW connector, show how every team is progressing on our [Quest name], and highlight where to focus. End with a 3-point summary I can paste into Slack.
Why this prompt: Naming the Quest keeps the report focused on one piece of training. Progress by team shows where to focus, and a short summary gives you something ready to share.
Steps:
- Replace [Quest name] with the name of your Quest, then send the prompt.
- Check the summary against the Quest's progress in SCW.
- Run the same prompt whenever you need an update, for example before each team meeting.
Pull compliance evidence
Show auditors which developers completed required training, for example for PCI DSS.
Before you start: a CSV file listing the developers in scope, with their email addresses.
Prompt:
Using the SCW connector, check whether each developer in the uploaded file completed our [Quest name] in the last 12 months. Show a yes/no table, the percentage compliant, and who hasn't completed it.
Why this prompt: Auditors usually ask about a set period, so the prompt names one. Naming the Quest defines what "trained" means, and the list of developers who haven't completed it gives you clear next steps.
Steps:
- Upload your developer list, replace [Quest name], and send the prompt.
- Share the list of developers who haven't completed it with their managers.
Tip: A completion older than 12 months counts as not compliant. Developers show as "not found" if the email in your file doesn't match their SCW login.
Keep the curriculum aligned with current risk
Turn scanner findings into training
Match training to the vulnerabilities your scanners actually find, and get a Quest draft ready to review.
Before you start: export your scanner findings as a CSV file, or have a list of CWEs ready.
Prompt:
Using the SCW connector and the uploaded scan, preview a short Quest for [team name] based on its top 3 findings. Don't create anything yet.
Why this prompt: Asking for a preview first lets you see who the Quest reaches and how long it takes before anything is saved. Limiting it to the top 3 findings keeps the Quest short and relevant.
Steps:
- Upload your scan file and send the prompt.
- Review the preview: how many learners it covers, the time to complete, and who still needs to choose a language.
- Ask for any changes. When you're happy, ask: "Create the draft and send me the link."
- Open the draft in SCW, review it, and publish it as usual.
Plan a curriculum by role and level
Get a training plan that gives each developer role the right topics, starting with the basics and building up over time.
Prompt:
Using the SCW connector, suggest a curriculum for our [roles, for example front-end, back-end and mobile developers]. Give each role a beginner, intermediate and advanced Quest using real SCW topics in the languages they use. Show it as a table and don't create anything yet.
Why this prompt: Naming the roles and levels gives the AI tool a clear structure to fill. Asking for real SCW topics keeps the plan to content that exists, and the table makes it easy to review before any Quest is drafted.
Steps:
- Replace the roles with your own and send the prompt.
- Adjust the plan, for example the order of topics or the number of levels.
- When you're happy, ask the AI tool to create a Quest draft for the first level of each role.
Show what your program is achieving
Compare assessment results before and after training
Show how developers' skills changed by comparing an assessment taken before training with one taken after.
Prompt:
Using the SCW connector, compare pre-assessment and post-assessment results for the developers who completed [Quest name], and summarize the improvement by team.
Why this prompt: Focusing on the developers who completed the Quest compares like with like. Breaking results down by team shows where skills improved and where to focus next.
Steps:
- Replace [Quest name] and send the prompt.
- Check the results in SCW before you share them.
Run a quick ROI check
Compare trained and untrained developers side by side: bugs per developer, the share of critical and high bugs, and days to fix.
Before you start: a scanner export that includes the developer's email address for each finding.
This example uses sample data.
Prompt:
Using the SCW connector and the uploaded scan, compare developers who completed SCW training in the last 12 months with those who didn't. Match them by developer_email. Describe the result as a correlation, not proof.
Why this prompt: Matching by email links each finding to the right developer's training record. Asking for a correlation keeps the result honest, because other factors also affect how many bugs a developer writes.
Steps:
- Upload your scan file and send the prompt.
- Check the numbers before you share them.
Put your SCW data to work
Run a security champions points program
Combine SCW data with your own lists to recognize the developers who do the most for secure coding. Before you start, have your security champions list ready as a file.
Prompt:
Using the SCW connector, combine Quest completion with the uploaded security champions list and calculate points for each champion. Explain the scoring and show the top 10.
Why this prompt: Combining Quest completion with your own champions list shows how SCW data can feed programs you already run. Asking for the scoring makes the points easy to explain and share.
Steps:
- Upload your champions list, send the prompt, and adjust what earns points to suit your program.
- Share the leaderboard with your teams, and run it again each quarter.
See AI usage across your developers
Find out how many developers code with AI, how much of your code is AI-assisted, and which AI tools they use.
Prompt:
Using the SCW connector, show how much of our code was AI-assisted in the last 90 days, using our AI usage data, and which AI tools our developers use.
Why this prompt: A set time period makes the numbers easy to compare from one quarter to the next. Asking about tools as well as volume shows which AI tools to cover in your AI policy and training.
Steps:
- Send the prompt.
- For more detail, follow up with: "List the top 10 AI users and their AI score."
Tip: No AI usage data yet? The AI tool will tell you. Ask your CSM about setting it up.
Good to know
- Answers use the same reporting data as your SCW dashboards, which updates a few hours behind platform activity, so very recent activity may not show yet. To check, ask: "When was the SCW reporting data last refreshed?"
- The AI tool works with your own SCW role and permissions. It can't show anything you can't already see in SCW.
- Check important numbers in SCW before you share them.
Tried these? Let your CSM know what worked and what didn't.
Comments
0 comments
Please sign in to leave a comment.