Sprinto MCP
Guide to integrate with Sprinto MCP alongside its capabilities.
1. Overview
What is Sprinto MCP?
Sprinto MCP (Model Context Protocol) is an integration that connects Sprinto's compliance automation platform directly to AI assistants like Claude. It allows you to interact with your Sprinto workspace using plain English — asking questions, pulling reports, and taking actions — without navigating the Sprinto UI.
Instead of clicking through dashboards, you can simply ask:
"Show me all failing monitors assigned to my team" "List all vendors without a completed risk assessment" "What controls are not yet mapped to SOC 2?"
Sprinto MCP translates these natural language requests into structured actions on your Sprinto account in real time.
Who is it for?
Sprinto MCP is designed for compliance managers, security leads, and IT administrators who use Sprinto daily and want to move faster without context-switching. It is particularly useful for:
Compliance managers who want quick status checks on audits, controls, and policies
Security teams tracking vendor risk, incidents, and monitor health
Ops and admin teams managing staff onboarding, offboarding, and access reviews
No coding knowledge is required. If you can describe what you need in plain English, Sprinto MCP can help.
What can you do with it?
Sprinto MCP gives you read and write access to most of Sprinto's core entities through conversational AI. You can:
Query compliance status, control readiness, vendor details, audit progress, and more
Take actions like creating risks, updating policies, closing incidents, onboarding staff, and submitting due diligence
Automate repetitive tasks like sending policy review reminders, bulk-importing vendors, or answering security questionnaires using your Knowledge Hub
Get summaries and diagnostics across frameworks, monitors, and evidence requests
How it works
Sprinto MCP uses the Model Context Protocol (MCP), an open standard that lets AI assistants securely call external tools and APIs on your behalf. When you ask a question or give an instruction in Claude, the AI identifies the right Sprinto tool to use, calls it with the correct parameters, and surfaces the result back to you — all within the conversation.
Your data stays within Sprinto's security boundaries. The AI does not store or cache your compliance data; it only retrieves or acts on it within the scope of your request.
2. Getting Started
Prerequisites
Before connecting Sprinto MCP, make sure you have:
An active Sprinto account with the relevant permissions for the actions you want to perform
Admin or editor-level access in Sprinto.
How to connect Sprinto MCP
Sprinto MCP connects via a custom URL based on the hosting region:
Follow the steps below for your AI client of choice.
2.1 Claude Web
Option 1: OAuth custom connector
Open Claude in the browser.
Go to Settings -> Connectors.
Click Add custom connector.
Enter a name, for example
Sprinto.Enter the MCP server URL:
Continue / create the connector.
Claude should redirect to the Sprinto login page.
Log in to Sprinto and approve/connect.
After redirecting back to Claude, confirm the Sprinto MCP connector is enabled.
Option 2: Developer API key / manual header
Use this only if you are configuring through CLI-style MCP config instead of the web connector UI.
You are now ready to use Sprinto MCP in any Claude conversation.
2.2 Claude Desktop
Option 1: OAuth custom connector
If Claude Desktop exposes Settings -> Connectors -> Add custom connector, use the same web connector flow:
It should redirect to Sprinto login and return with the MCP connector enabled.
Option 2: Developer API key / manual config
If Claude Desktop exposes a custom MCP server config UI, use:
If Claude Desktop reads the same MCP config created by Claude Code, the Claude Code CLI command above may make the sprinto server available there too.
2.3 Claude Code CLI
Prerequisites
Claude Code installed globally:
A Sprinto developer API key. This is a UUID generated from a Sprinto org you can access, for example CARS.
Get Your Sprinto Dev Key
Login to your Sprinto
Go to Settings -> Developer API.
Click Generate key.
Copy the generated UUID.
Use it as the raw header value:
Do not prefix the developer API key with Bearer.
Add The Sprinto MCP Server
Replace <YOUR_DEV_KEY> with your raw UUID key.
Verify The Server
You should see the sprinto MCP server in the configured server list.
Use In Claude Code
Run Claude Code:
In the session, run:
Confirm Sprinto tools are visible in the MCP tool list.
You're all set to ask questions and complete tasks on Claude Code.
2.4 ChatGPT
Option 1: OAuth app / connector
This is the tested production path.
Open ChatGPT web.
Go to Settings -> Apps / Connectors.
Click Create app or Create connector.
Enter a name, for example
Sprinto.Enter the MCP server URL:
Choose OAuth as the authentication method.
Click Create.
ChatGPT should redirect to the Sprinto login page.
Log in and approve/connect.
After redirecting back to ChatGPT, test with:
Note: In the current tested flow, ChatGPT did not require manually entering a client ID. Adding the URL and choosing OAuth was enough to trigger the Sprinto login flow.
Option 2: Developer API key / custom header
Use this only if the ChatGPT UI exposes custom-header authentication for the app/connector.
If custom headers are not available, use OAuth.
2.5 Cursor
Option 1: Add MCP from Cursor UI
Use this when Cursor exposes the MCP integration UI.
Open Cursor.
Go to Settings / Integrations.
Open the MCP section.
Click Add MCP.
Enter a name, for example
Sprinto.Enter the MCP server URL:
If Cursor offers OAuth, choose OAuth and continue.
Cursor should redirect to the Sprinto login page.
Log in to Sprinto and approve/connect.
Return to Cursor and confirm the Sprinto MCP server is enabled.
Verify by asking Cursor:
Option 2: Developer API key / .cursor/mcp.json
Use this if the Cursor UI flow is unavailable or OAuth does not complete.
Create or update .cursor/mcp.json in the repo root, or ~/.cursor/mcp.json for global use:
Important notes:
Replace
<YOUR_DEV_KEY>with the raw developer API UUID.Do not prefix the developer API key with
Bearer.Restart or refresh Cursor MCP settings after editing the file.
Authentication and permissions
Sprinto MCP acts on behalf of your authenticated Sprinto account. The actions available to you through the AI are governed by your Sprinto role and permissions — the same way they are in the Sprinto UI. If your Sprinto role does not permit a certain action (for example, approving a policy), the AI will not be able to perform it either.
Read-only users can query and explore data. Editor and admin users can take write actions.
3. Capabilities by Entity
The following sections describe what you can do with Sprinto MCP for each major entity type. Each section includes the types of actions available and example prompts you can try.
Workspace & Account
Get oriented in your Sprinto workspace — your org profile, active frameworks, and role — before diving into a specific entity.
What you can do:
View your authenticated profile, role, and organization details
List every organization/workspace you have access to
Pull a current org profile: active frameworks, category setup status, and overall compliance posture
Check whether a specific feature flag is enabled for your org
Check which zones a given entity belongs to
Example prompts:
"What's my current Sprinto profile and role?" "Give me a snapshot of our compliance status across all frameworks." "Which organizations do I have access to?" "Is the AI risk module enabled for our org?"
Access & Critical Access Systems
Manage who has access to your organization's critical systems (AWS IAM, GitHub, GCP, etc.), and configure Critical Access System (CAS) rules — both automated and manual.
What you can do:
List all critical access systems and see who has access to each
Create or edit automated and manual Critical Access Systems
View detailed access-control entity records (who has access to what, and how)
Bulk-update access-user connections and mark non-human/service accounts
Resolve unmatched Manual CAS entries against real staff records
Manage ticketing collections used in CAS workflows
Check MFA monitor status across all active auto-CAS systems
Example prompts:
"List all critical access systems in my org." "Show me who has access to our AWS environment." "Set up a new critical access system for our GitHub org." "Which of our CAS systems are missing MFA enforcement?"
Access Reviews & Management Reviews
Run user access review campaigns and other management review sessions, and track their completion.
What you can do:
Create a new management review session (access review or other review types)
Review and record decisions for individual users within an access review
Finish/close out a completed access review session
View full details of a review — scope, reviewers, and status
List per-user access review decisions for a given review
List all management reviews of a given type for the org
Example prompts:
"Start a new access review for our production AWS account." "Show me the pending decisions in the current access review." "Mark John's access as approved in the ongoing review." "Close out this quarter's access review."
AI Systems
Track AI-specific risk and security assessments as a distinct category from general vendor risk.
What you can do:
View the AI system security questionnaire for your org
View AI system questionnaire questions grouped by domain/section
Example prompts:
"Show me our AI system security questionnaire." "What domains does our AI systems assessment cover, and where are the gaps?"
Audits
Create and manage compliance audits, track audit tasks, findings, and reports, and monitor progress across lifecycle stages — including auditor-facing views.
What you can do:
Create new compliance audits and update their parameters
Add or remove controls (and other requirements) from a custom audit
Add documents to an audit — uploaded files, generated docs, or existing policies
Upload or replace the final report for an audit
Update evidence review status for audit items, individually or in bulk
Add internal notes to a specific audit item
View audit item lists, evidence sampling results, and uploaded report documents
View audit statistics: findings by severity, open discussion threads, task counts, and lifecycle-stage breakdown
View audits and audit items scoped specifically to an external auditor's access
Example prompts:
"Create a new SOC 2 Type II audit." "How many audits are currently in the evidence collection stage?" "Show me the open discussion threads across all my audits." "Upload this report as the final deliverable for our ISO audit." "What does the auditor currently see for this engagement?"
Change Management & Code Repositories
Track the repositories connected to your change-management process and their tracking configuration.
What you can do:
List the change-management (ticketing) systems configured for your org
List connected source-code repositories and their tracking status
Create or edit the change-management config for a repository
Update whether a repository is actively tracked
Pull Dependabot vulnerability alerts for tracked repositories
Example prompts:
"List all repositories we're tracking for change management." "Turn on tracking for our new backend repo." "Show me open Dependabot alerts across our repos."
Checks & Monitors
View and manage automated compliance monitors and manual workflow checks, track their health, and resolve failures.
What you can do:
List all automated monitors and manual workflow checks, and the check-template catalog available to add
Create, enable, disable, or update custom checks and programmable monitors
Resolve a check directly by submitting the required evidence
Add evidence or exceptions to a monitor
View run history, day-by-day evaluation status, and summarized pass/fail counts for any check
Get remediation steps and a help link for a failing monitor
Send reminders to staff with failing, due, or escalated checks
Example prompts:
"Which monitors are currently failing?" "Show me the remediation steps for the failing MFA monitor." "Send reminders to all owners with failing checks." "What's the pass/fail history for the endpoint encryption monitor over the last 30 days?"
Commitments
Track the organization's standing security/compliance commitments — the promises made to customers or in contracts that Sprinto monitors on your behalf.
What you can do:
List all active commitments for the org
Example prompts:
"What security commitments have we made that are currently being tracked?"
Controls
Create, map, and manage compliance controls across frameworks and policies.
What you can do:
Create new custom controls and edit existing ones
Enable or disable controls for your organization
Map controls to framework principles, org frameworks, and org policy types
Attach evidence to a control
View control details, mapped policies, check summaries, mitigated risks, and owners
See aggregate control counts and readiness/setup status across the org
Example prompts:
"List all controls that are not yet set up." "Map control CC6.1 to our SOC 2 framework." "Which controls does John own?" "Show me the check summary for control CC7.2." "How many controls are mapped to ISO 27001?"
Conversations & Notifications
Post updates directly onto Sprinto entities and trigger notifications to the right people.
What you can do:
Post a message to an entity's conversation thread (control, audit item, etc.) and notify participants
Pull the message history for a conversation
Send an ad-hoc email, Slack, or Microsoft Teams notification to org users
Example prompts:
"Post an update on the SOC 2 evidence request thread saying the doc is uploaded." "What's been discussed on this control's thread?" "Notify the security channel that the pentest report is ready."
Custom Attributes
Define and manage custom fields on Sprinto entities to capture org-specific metadata.
What you can do:
Create new custom attribute (custom field) definitions for supported entity types
Update existing custom field definitions
Set or update custom field values on specific entities (vendors, risks, and more)
Example prompts:
"Add a custom field called 'Data Classification' to the vendor entity." "Update the 'Business Owner' custom field for vendor Acme Corp to Jane Doe."
Employees & Users
Manage staff members, their roles, onboarding and offboarding, scope status, and background checks.
What you can do:
Create new staff members and trigger onboarding, including org-wide onboarding configuration
Start offboarding for departing employees
Send onboarding reminders to specific staff
Record manual background-check reports
Update a user's in-scope/out-of-scope status and reporting structure
Create custom staff roles and manage system-group membership
Query users by role, system group, manager, scope status, or email — including active, offboarded, admin, and non-admin/non-infosec segments
Get headcounts: active users, active in-scope users, offboarded users, total users
Example prompts:
"Add a new staff member: Jane Doe, jane@example.com." "Start offboarding for john@example.com." "How many active in-scope users do we have?" "Who are the people managers in our org?" "Show me all users who are not admins and not in the infosec group."
Employee Groups
View and manage employee groups, their members, and the HR/directory sources that populate them.
What you can do:
List all employee groups and their members, including a preview of who would match a custom group rule
View employee groups by provider source (e.g., Google Workspace, Okta)
Query relations, memberships, and deduplicated user sets across groups
Get group counts broken down by source
Example prompts:
"List all employee groups in our org." "Which users are in the Engineering group?" "What HR integrations are we using as sources for employee groups?" "How many employee groups do we have from each source?"
Endpoints & Devices
Track and manage staff device (endpoint) records and connected MDM providers.
What you can do:
Update endpoint records for staff devices (compliance status, ownership, etc.)
View full detail for a specific staff device
List all enrolled staff devices and connected MDM providers
Example prompts:
"Update the endpoint record for John's MacBook to mark it as compliant." "List all devices enrolled through our MDM."
Evidence & Evidence Requests
Upload, track, and query manual evidence files and evidence requests across your compliance program.
What you can do:
Create org-level manual evidence records from external file links
Attach custom evidence to monitors and controls
Create, update, or archive evidence requests — individually or in bulk — and notify participants
Update the review status of evidence, individually or in bulk
List all uploaded manual evidence and view request counts (total vs. archived)
List which control checks have evidence attached
Example prompts:
"List all manual evidence files uploaded in the last 30 days." "How many evidence requests are currently open?" "Attach this evidence file to the encryption-at-rest monitor." "Create an evidence request for our Q3 access review and assign it to the security team."
Findings
Create and manage findings linked to audits, vendors, controls, or risk items.
What you can do:
Create new findings under any parent entity (audit, vendor, control, risk item)
Update existing findings with new information
View finding details and get total finding counts, optionally scoped to a parent entity
Example prompts:
"Create a new finding under our SOC 2 audit for a missing access control policy." "Update the finding on vendor Acme Corp to mark it as remediated." "How many open findings do we have across all vendors?"
Frameworks
Enable, configure, and manage compliance frameworks and their criteria (principles) within your organization.
What you can do:
List all active, eligible, and unfiltered compliance frameworks
Enable or disable frameworks for your org
Create a custom framework from scratch, or parse one directly from an uploaded document
Add, enable, disable, and update framework criteria (principles), including audit justification text
Map controls to framework principles and org frameworks
View per-framework control setup/readiness counts and check-health summaries
See how many framework criteria are mapped to controls
Example prompts:
"Which compliance frameworks are we currently working toward?" "Enable the ISO 27001 framework for our org." "Create a custom framework from this regulatory document." "How many SOC 2 criteria are not yet mapped to controls?" "Show me the check-health summary across all our active frameworks."
Incidents
Track and manage security and operational incidents, update their severity, and close them individually or in bulk.
What you can do:
List all incidents with filtering options, and see the available filter values
Close single or multiple incidents in bulk
Update incident severity and data-loss/customer-impact details
View connected incident sources and incident-management providers
List incidents self-reported by staff
Example prompts:
"List all open high-severity incidents." "Close all resolved incidents from last month." "Update the severity of incident #42 to Medium." "What incidents have customer data impact?"
Infrastructure
View and classify your cloud infrastructure resources across connected providers like AWS, GCP, and Azure.
What you can do:
List all connected cloud/infrastructure providers
View active infrastructure resources and the distinct resource types present
Update the classification of an individual infrastructure entity, or bulk-classify Security Hub/infra entities
Update the smart default classification for a provider
Example prompts:
"List all connected cloud infrastructure providers." "Show me all unclassified infrastructure resources." "Classify our production EC2 instance as in-scope." "What infrastructure resource types do we have across our AWS account?"
Knowledge Hub & Cross-Entity Search
Search across your organization's uploaded documents and previously approved answers, and run general-purpose Sprinto lookups without knowing the exact tool name.
What you can do:
Search the Knowledge Hub for relevant documents and approved Q&A pairs
Auto-answer a batch of questions using the Knowledge Hub
Look up available Sprinto operations or read-queries by describing what you need in plain English
Example prompts:
"Search our Knowledge Hub for anything about incident response timelines." "Auto-answer these 20 questionnaire rows from what we already have on file."
Pentests
Manage penetration tests, vulnerabilities, and reports within your compliance program.
What you can do:
List all pentests and their statuses, and get an org-wide pentest overview
View pentest vulnerabilities across the organization
Create vulnerabilities for a given pentest report
Retrieve the latest report for a specific pentest
Example prompts:
"List all our penetration tests." "Show me all open vulnerabilities from our last pentest." "What is the latest report for our Q1 2025 pentest?"
Policies
Create, update, approve, and manage your organization's compliance policies and policy documents.
What you can do:
Create new custom policies — editable, user-authored, or uploaded documents
Update policy draft content and document details (owner, reviewer, etc.)
Send policies for approval and/or approve them; mark approvals obtained outside Sprinto
Upgrade a Sprinto-managed policy to a newer version
Enable or disable policy types for your org
Upload policy documents from external sources
Notify policy reviewers directly
View policy content, version history, drift reports, gap analysis, and branding config
View policies by type, by register, and get a signed download/preview URL (Markdown or PDF) for any policy or template
Search policy content by keyword across name, type, and description
Example prompts:
"Which policies are currently in draft and not yet approved?" "Show me our policy gap analysis." "Send review notifications to all policy reviewers." "Approve the Access Control Policy." "List all policies in our Information Security policy register." "Which policies have drifted from their expected state?"
Policy Exceptions
Request, grant, and track exceptions to policy requirements across your organization.
What you can do:
Create a new policy exception and notify the assigned analyst
List all policy exceptions org-wide, or scoped to the current user
Retrieve a specific policy exception by ID, and get the total exception count
Example prompts:
"How many policy exceptions do we currently have?" "List all active policy exceptions in our org." "Show me the policy exceptions assigned to me." "Grant an exception to the password rotation policy for the DevOps team, expiring in 90 days."
Risks
Create, import, assess, and manage risks in your organization's risk register.
What you can do:
Create custom org risk items, or bulk-import/bulk-update risk records
Approve, update, and map risks to entities; add mitigating notes
Create or complete a risk assessment, and pull the latest completed snapshot
Update org risk profiles, categories, and custom rating scales
View all risks with filtering, plus untreated risks with no selected treatment plan
See risk score formulas, heatmap distribution, and aggregate risk reporting
View which controls or assets are mapped to mitigate a given risk
Example prompts:
"List all high-rated risks in our risk register." "Create a new risk for third-party vendor data exposure." "Which controls are mapped to mitigate our data breach risk?" "What is our risk scoring formula?" "Show me all untreated risks." "Approve the pending risk items in our register."
Security Questionnaires
Import, answer, and manage security questionnaires — including vendor-facing and AI-system assessments.
What you can do:
Import a security questionnaire from an uploaded file (Excel, CSV, Word, PDF) and classify its columns
Trigger automatic question extraction and answer generation from the Knowledge Hub
Bulk-approve questions, and bulk-reassign owner or reviewer
Create or update auto-response Q&A pairs in the Knowledge Hub
View questionnaire items grouped by domain, for both vendor and AI-system questionnaires
Create or update a reusable vendor questionnaire template
Example prompts:
"Import this security questionnaire and generate answers from our Knowledge Hub." "Show me all unanswered questions in our current vendor questionnaire." "Bulk-approve all questions in section 3 of the questionnaire." "Add a new auto-response answer for MFA questions to our Knowledge Hub."
Tasks
Create, assign, update, and close compliance tasks and workflow actions across your org.
What you can do:
Create new custom tasks tied to vendor and risk workflows
Update task details and close completed tasks
Approve or reject a workflow node action (e.g., an approval step in a review chain)
Mark a task as approved when the approval happened outside Sprinto
List tasks assigned to you, tied to a specific entity, or across the org
Example prompts:
"List all my open compliance tasks." "Create a task to collect the latest SOC 2 report from Vendor X." "Close task #15 — it's been completed." "Show me all tasks tied to our Acme Corp vendor record."
Training & Policy Acknowledgements
Track staff completion of security training and policy read-and-acknowledge requirements, including training synced from external LMS platforms.
What you can do:
Create a policy or training acknowledgement batch and notify assigned staff
Send reminders to staff with pending policy acknowledgements
View acknowledgement rate for a policy type, and staff-level acknowledgement status
List training requirements, connected training providers, and external training campaigns
View per-user training and onboarding-training completion status
Example prompts:
"What's our acknowledgement rate for the updated Acceptable Use Policy?" "Send reminders to everyone who hasn't acknowledged the new policy yet." "Which employees haven't completed onboarding security training?" "List our connected training providers."
Vendors
Manage your vendor register end-to-end — from discovery and onboarding to risk assessment, documents, and due diligence.
What you can do:
Add single or multiple vendors; bulk-import a full vendor list
Update vendor details and risk-factor scores across configured risk dimensions
Submit vendor due-diligence assessments and view outstanding due-diligence checklist items
Create, reactivate, or list vendor integration connections
Request, upload, name, and track expiry for vendor documents; view combined document/request summaries
View vendor risk assessments, live risk pulse (by website URL), and risk-level distribution across the register
Discover vendors suggested by connected integrations (e.g., Google Workspace), dismiss suggestions, and review decisioning info
Search the external Sprinto vendor catalog for pre-built profiles
View vendor onboarding/intake requests and default register/admin configuration
Get aggregate vendor reporting: overview stats, total counts, and Sprinto auto-collected document counts
Example prompts:
"List all active vendors in our org." "Which vendors don't have a completed due diligence assessment?" "Add Acme Corp as a new vendor with High data sensitivity." "Show me the risk pulse for vendor stripe.com." "What new vendors has Sprinto suggested from our Google Workspace?" "Send a document upload request to Acme Corp for their SOC 2 report." "How many vendor documents has Sprinto auto-collected for us?"
Vulnerability Management
Track vulnerability scanning coverage and results separately from pentest-specific findings.
What you can do:
Register vulnerability-scanning providers for the org
List connected vulnerability-scanning providers and the entities they track
View vendor-side (infrastructure/container/SCA) vulnerabilities detected through connected scanners
Example prompts:
"What vulnerability scanning providers are connected to our org?" "Show me all critical vulnerabilities flagged on our production infrastructure."
4. Support
The capabilities listed in this documentation reflect what is available today, and we are actively expanding what you can do — including deeper workflow automation, richer reporting, and support for more Sprinto entities.
If you run into any issues, unexpected behavior, or have feedback on what you'd like to see next, reach out to us at support@sprinto.com. We'd love to hear from you.
Last updated