> For the complete documentation index, see [llms.txt](https://docs.sprinto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sprinto.com/sprinto-ai/sprinto-mcp.md).

# Sprinto MCP

### 1. Overview

#### What is Sprinto MCP?

Sprinto MCP (Model Context Protocol) is an integration that connects Sprinto's compliance automation platform directly to AI assistants like Claude. It allows you to interact with your Sprinto workspace using plain English — asking questions, pulling reports, and taking actions — without navigating the Sprinto UI.

Instead of clicking through dashboards, you can simply ask:

> *"Show me all failing monitors assigned to my team"* *"List all vendors without a completed risk assessment"* *"What controls are not yet mapped to SOC 2?"*

Sprinto MCP translates these natural language requests into structured actions on your Sprinto account in real time.

#### Who is it for?

Sprinto MCP is designed for compliance managers, security leads, and IT administrators who use Sprinto daily and want to move faster without context-switching. It is particularly useful for:

* **Compliance managers** who want quick status checks on audits, controls, and policies
* **Security teams** tracking vendor risk, incidents, and monitor health
* **Ops and admin teams** managing staff onboarding, offboarding, and access reviews

No coding knowledge is required. If you can describe what you need in plain English, Sprinto MCP can help.

#### What can you do with it?

Sprinto MCP gives you read and write access to most of Sprinto's core entities through conversational AI. You can:

* **Query** compliance status, control readiness, vendor details, audit progress, and more
* **Take actions** like creating risks, updating policies, closing incidents, onboarding staff, and submitting due diligence
* **Automate repetitive tasks** like sending policy review reminders, bulk-importing vendors, or answering security questionnaires using your Knowledge Hub
* **Get summaries and diagnostics** across frameworks, monitors, and evidence requests

#### How it works

Sprinto MCP uses the Model Context Protocol (MCP), an open standard that lets AI assistants securely call external tools and APIs on your behalf. When you ask a question or give an instruction in Claude, the AI identifies the right Sprinto tool to use, calls it with the correct parameters, and surfaces the result back to you — all within the conversation.

Your data stays within Sprinto's security boundaries. The AI does not store or cache your compliance data; it only retrieves or acts on it within the scope of your request.

***

### 2. Getting Started

#### Prerequisites

Before connecting Sprinto MCP, make sure you have:

* An active Sprinto account with the relevant permissions for the actions you want to perform
* Admin or editor-level access in Sprinto.

#### How to connect Sprinto MCP

Sprinto MCP connects via a custom URL based on the hosting region:

{% tabs %}
{% tab title="US" %}

```
https://mcp.sprinto.com/mcp
```

{% endtab %}

{% tab title="EU" %}

```
https://mcp.eu.sprinto.com/mcp
```

{% endtab %}

{% tab title="IN" %}

```
https://mcp.in.sprinto.com/mcp
```

{% endtab %}

{% tab title="AU" %}

```
https://mcp.au.sprinto.com/mcp
```

{% endtab %}
{% endtabs %}

Follow the steps below for your AI client of choice.

### 2.1 Claude Web

#### Option 1: OAuth custom connector

1. Open Claude in the browser.
2. Go to **Settings -> Connectors**.
3. Click **Add custom connector**.
4. Enter a name, for example `Sprinto`.
5. Enter the MCP server URL:

{% tabs %}
{% tab title="US" %}

```
https://mcp.sprinto.com/mcp
```

{% endtab %}

{% tab title="EU" %}

```
https://mcp.eu.sprinto.com/mcp
```

{% endtab %}

{% tab title="IN" %}

```
https://mcp.in.sprinto.com/mcp
```

{% endtab %}

{% tab title="AU" %}

```
https://mcp.au.sprinto.com/mcp
```

{% endtab %}
{% endtabs %}

6. Continue / create the connector.
7. Claude should redirect to the Sprinto login page.
8. Log in to Sprinto and approve/connect.
9. After redirecting back to Claude, confirm the Sprinto MCP connector is enabled.

#### Option 2: Developer API key / manual header

Use this only if you are configuring through CLI-style MCP config instead of the web connector UI.

{% tabs %}
{% tab title="US" %}

```
https://mcp.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="EU" %}

```
https://mcp.eu.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="IN" %}

```
https://mcp.in.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="AU" %}

```
https://mcp.au.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}
{% endtabs %}

You are now ready to use Sprinto MCP in any Claude conversation.

### 2.2 Claude Desktop

#### Option 1: OAuth custom connector

If Claude Desktop exposes **Settings -> Connectors -> Add custom connector**, use the same web connector flow:

{% tabs %}
{% tab title="US" %}

```
Name: Sprinto
https://mcp.sprinto.com/mcp
Auth: OAuth
```

{% endtab %}

{% tab title="EU" %}

```
Name: Sprinto
https://mcp.eu.sprinto.com/mcp
Auth: OAuth
```

{% endtab %}

{% tab title="IN" %}

```
Name: Sprinto
https://mcp.in.sprinto.com/mcp
Auth: OAuth
```

{% endtab %}

{% tab title="AU" %}

```
Name: Sprinto
https://mcp.au.sprinto.com/mcp
Auth: OAuth
```

{% endtab %}
{% endtabs %}

It should redirect to Sprinto login and return with the MCP connector enabled.

#### Option 2: Developer API key / manual config

If Claude Desktop exposes a custom MCP server config UI, use:

{% tabs %}
{% tab title="US" %}

```
https://mcp.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="EU" %}

```
https://mcp.eu.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="IN" %}

```
https://mcp.in.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="AU" %}

```
https://mcp.au.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}
{% endtabs %}

If Claude Desktop reads the same MCP config created by Claude Code, the Claude Code CLI command above may make the `sprinto` server available there too.

### 2.3 Claude Code CLI

#### Prerequisites

* Claude Code installed globally:

```bash
npm i -g @anthropic-ai/claude-code
```

* A Sprinto developer API key. This is a UUID generated from a Sprinto org you can access, for example CARS.

#### Get Your Sprinto Dev Key

1. Login to your Sprinto
2. Go to **Settings -> Developer API**.
3. Click **Generate key**.
4. Copy the generated UUID.
5. Use it as the raw header value:

```
Authorization: <YOUR_DEV_KEY>
```

Do **not** prefix the developer API key with `Bearer`.

#### Add The Sprinto MCP Server

Replace `<YOUR_DEV_KEY>` with your raw UUID key.

{% tabs %}
{% tab title="US" %}

```
claude mcp add --transport http sprinto https://mcp.sprinto.com/mcp \
  --header "Authorization: <YOUR_DEV_KEY>"
```

{% endtab %}

{% tab title="EU" %}

```
claude mcp add --transport http sprinto https://mcp.eu.sprinto.com/mcp \
  --header "Authorization: <YOUR_DEV_KEY>"
```

{% endtab %}

{% tab title="IN" %}

```
claude mcp add --transport http sprinto https://mcp.in.sprinto.com/mcp \
  --header "Authorization: <YOUR_DEV_KEY>"
```

{% endtab %}

{% tab title="AU" %}

```
claude mcp add --transport http sprinto https://mcp.au.sprinto.com/mcp \
  --header "Authorization: <YOUR_DEV_KEY>"
```

{% endtab %}
{% endtabs %}

#### Verify The Server

```bash
claude mcp list
```

You should see the `sprinto` MCP server in the configured server list.

#### Use In Claude Code

1. Run Claude Code:

```bash
claude
```

2. In the session, run:

```
/mcp
```

3. Confirm Sprinto tools are visible in the MCP tool list.
4. You're all set to ask questions and complete tasks on Claude Code.&#x20;

### 2.4 ChatGPT

#### Option 1: OAuth app / connector

This is the tested production path.

1. Open ChatGPT web.
2. Go to **Settings -> Apps / Connectors**.
3. Click **Create app** or **Create connector**.
4. Enter a name, for example `Sprinto`.
5. Enter the MCP server URL:

{% tabs %}
{% tab title="US" %}

```
https://mcp.sprinto.com/mcp
```

{% endtab %}

{% tab title="EU" %}

```
https://mcp.eu.sprinto.com/mcp
```

{% endtab %}

{% tab title="IN" %}

```
https://mcp.in.sprinto.com/mcp
```

{% endtab %}

{% tab title="AU" %}

```
https://mcp.au.sprinto.com/mcp
```

{% endtab %}
{% endtabs %}

6. Choose **OAuth** as the authentication method.
7. Click **Create**.
8. ChatGPT should redirect to the Sprinto login page.
9. Log in and approve/connect.
10. After redirecting back to ChatGPT, test with:

```
Use the Sprinto MCP server to show my workspace context.
```

Note: In the current tested flow, ChatGPT did **not** require manually entering a client ID. Adding the URL and choosing OAuth was enough to trigger the Sprinto login flow.

#### Option 2: Developer API key / custom header

Use this only if the ChatGPT UI exposes custom-header authentication for the app/connector.

{% tabs %}
{% tab title="US" %}

```
https://mcp.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="EU" %}

```
https://mcp.eu.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="IN" %}

```
https://mcp.in.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}

{% tab title="AU" %}

```
https://mcp.au.sprinto.com/mcp
Header: Authorization: <YOUR_DEV_KEY>
```

{% endtab %}
{% endtabs %}

If custom headers are not available, use OAuth.

### **2.5 Cursor**

#### Option 1: Add MCP from Cursor UI

Use this when Cursor exposes the MCP integration UI.

1. Open Cursor.
2. Go to **Settings / Integrations**.
3. Open the **MCP** section.
4. Click **Add MCP**.
5. Enter a name, for example `Sprinto`.
6. Enter the MCP server URL:

{% tabs %}
{% tab title="US" %}

```
https://mcp.sprinto.com/mcp
```

{% endtab %}

{% tab title="EU" %}

```
https://mcp.eu.sprinto.com/mcp
```

{% endtab %}

{% tab title="IN" %}

```
https://mcp.in.sprinto.com/mcp
```

{% endtab %}

{% tab title="AU" %}

```
https://mcp.au.sprinto.com/mcp
```

{% endtab %}
{% endtabs %}

7. If Cursor offers OAuth, choose OAuth and continue.
8. Cursor should redirect to the Sprinto login page.
9. Log in to Sprinto and approve/connect.
10. Return to Cursor and confirm the Sprinto MCP server is enabled.
11. Verify by asking Cursor:

```
Use the Sprinto MCP server to show my workspace context.
```

#### Option 2: Developer API key / `.cursor/mcp.json`

Use this if the Cursor UI flow is unavailable or OAuth does not complete.

Create or update `.cursor/mcp.json` in the repo root, or `~/.cursor/mcp.json` for global use:

{% tabs %}
{% tab title="US" %}

```
{
  "mcpServers": {
    "sprinto": {
      "url": "https://mcp.sprinto.com/mcp",
      "headers": {
        "Authorization": "<YOUR_DEV_KEY>"
      }
    }
  }
}
```

{% endtab %}

{% tab title="EU" %}

```
{
  "mcpServers": {
    "sprinto": {
      "url": "https://mcp.eu.sprinto.com/mcp",
      "headers": {
        "Authorization": "<YOUR_DEV_KEY>"
      }
    }
  }
}
```

{% endtab %}

{% tab title="IN" %}

```
{
  "mcpServers": {
    "sprinto": {
      "url": "https://mcp.in.sprinto.com/mcp",
      "headers": {
        "Authorization": "<YOUR_DEV_KEY>"
      }
    }
  }
}
```

{% endtab %}

{% tab title="AU" %}

```
{
  "mcpServers": {
    "sprinto": {
      "url": "https://mcp.au.sprinto.com/mcp",
      "headers": {
        "Authorization": "<YOUR_DEV_KEY>"
      }
    }
  }
}
```

{% endtab %}
{% endtabs %}

Important notes:

* Replace `<YOUR_DEV_KEY>` with the raw developer API UUID.
* Do **not** prefix the developer API key with `Bearer`.
* Restart or refresh Cursor MCP settings after editing the file.

#### Authentication and permissions

Sprinto MCP acts on behalf of your authenticated Sprinto account. The actions available to you through the AI are governed by your Sprinto role and permissions — the same way they are in the Sprinto UI. If your Sprinto role does not permit a certain action (for example, approving a policy), the AI will not be able to perform it either.

Read-only users can query and explore data. Editor and admin users can take write actions.

***

### 3. Capabilities by Entity

The following sections describe what you can do with Sprinto MCP for each major entity type. Each section includes the types of actions available and example prompts you can try.

#### Workspace & Account

Get oriented in your Sprinto workspace — your org profile, active frameworks, and role — before diving into a specific entity.

**What you can do:**

* View your authenticated profile, role, and organization details
* List every organization/workspace you have access to
* Pull a current org profile: active frameworks, category setup status, and overall compliance posture
* Check whether a specific feature flag is enabled for your org
* Check which zones a given entity belongs to

**Example prompts:**

> *"What's my current Sprinto profile and role?"* *"Give me a snapshot of our compliance status across all frameworks."* *"Which organizations do I have access to?"* *"Is the AI risk module enabled for our org?"*

#### Access & Critical Access Systems

Manage who has access to your organization's critical systems (AWS IAM, GitHub, GCP, etc.), and configure Critical Access System (CAS) rules — both automated and manual.

**What you can do:**

* List all critical access systems and see who has access to each
* Create or edit automated and manual Critical Access Systems
* View detailed access-control entity records (who has access to what, and how)
* Bulk-update access-user connections and mark non-human/service accounts
* Resolve unmatched Manual CAS entries against real staff records
* Manage ticketing collections used in CAS workflows
* Check MFA monitor status across all active auto-CAS systems

**Example prompts:**

> *"List all critical access systems in my org."* *"Show me who has access to our AWS environment."* *"Set up a new critical access system for our GitHub org."* *"Which of our CAS systems are missing MFA enforcement?"*

#### Access Reviews & Management Reviews

Run user access review campaigns and other management review sessions, and track their completion.

**What you can do:**

* Create a new management review session (access review or other review types)
* Review and record decisions for individual users within an access review
* Finish/close out a completed access review session
* View full details of a review — scope, reviewers, and status
* List per-user access review decisions for a given review
* List all management reviews of a given type for the org

**Example prompts:**

> *"Start a new access review for our production AWS account."* *"Show me the pending decisions in the current access review."* *"Mark John's access as approved in the ongoing review."* *"Close out this quarter's access review."*

#### AI Systems

Track AI-specific risk and security assessments as a distinct category from general vendor risk.

**What you can do:**

* View the AI system security questionnaire for your org
* View AI system questionnaire questions grouped by domain/section

**Example prompts:**

> *"Show me our AI system security questionnaire."* *"What domains does our AI systems assessment cover, and where are the gaps?"*

#### Audits

Create and manage compliance audits, track audit tasks, findings, and reports, and monitor progress across lifecycle stages — including auditor-facing views.

**What you can do:**

* Create new compliance audits and update their parameters
* Add or remove controls (and other requirements) from a custom audit
* Add documents to an audit — uploaded files, generated docs, or existing policies
* Upload or replace the final report for an audit
* Update evidence review status for audit items, individually or in bulk
* Add internal notes to a specific audit item
* View audit item lists, evidence sampling results, and uploaded report documents
* View audit statistics: findings by severity, open discussion threads, task counts, and lifecycle-stage breakdown
* View audits and audit items scoped specifically to an external auditor's access

**Example prompts:**

> *"Create a new SOC 2 Type II audit."* *"How many audits are currently in the evidence collection stage?"* *"Show me the open discussion threads across all my audits."* *"Upload this report as the final deliverable for our ISO audit."* *"What does the auditor currently see for this engagement?"*

#### Change Management & Code Repositories

Track the repositories connected to your change-management process and their tracking configuration.

**What you can do:**

* List the change-management (ticketing) systems configured for your org
* List connected source-code repositories and their tracking status
* Create or edit the change-management config for a repository
* Update whether a repository is actively tracked
* Pull Dependabot vulnerability alerts for tracked repositories

**Example prompts:**

> *"List all repositories we're tracking for change management."* *"Turn on tracking for our new backend repo."* *"Show me open Dependabot alerts across our repos."*

#### Checks & Monitors

View and manage automated compliance monitors and manual workflow checks, track their health, and resolve failures.

**What you can do:**

* List all automated monitors and manual workflow checks, and the check-template catalog available to add
* Create, enable, disable, or update custom checks and programmable monitors
* Resolve a check directly by submitting the required evidence
* Add evidence or exceptions to a monitor
* View run history, day-by-day evaluation status, and summarized pass/fail counts for any check
* Get remediation steps and a help link for a failing monitor
* Send reminders to staff with failing, due, or escalated checks

**Example prompts:**

> *"Which monitors are currently failing?"* *"Show me the remediation steps for the failing MFA monitor."* *"Send reminders to all owners with failing checks."* *"What's the pass/fail history for the endpoint encryption monitor over the last 30 days?"*

#### Commitments

Track the organization's standing security/compliance commitments — the promises made to customers or in contracts that Sprinto monitors on your behalf.

**What you can do:**

* List all active commitments for the org

**Example prompts:**

> *"What security commitments have we made that are currently being tracked?"*

#### Controls

Create, map, and manage compliance controls across frameworks and policies.

**What you can do:**

* Create new custom controls and edit existing ones
* Enable or disable controls for your organization
* Map controls to framework principles, org frameworks, and org policy types
* Attach evidence to a control
* View control details, mapped policies, check summaries, mitigated risks, and owners
* See aggregate control counts and readiness/setup status across the org

**Example prompts:**

> *"List all controls that are not yet set up."* *"Map control CC6.1 to our SOC 2 framework."* *"Which controls does John own?"* *"Show me the check summary for control CC7.2."* *"How many controls are mapped to ISO 27001?"*

#### Conversations & Notifications

Post updates directly onto Sprinto entities and trigger notifications to the right people.

**What you can do:**

* Post a message to an entity's conversation thread (control, audit item, etc.) and notify participants
* Pull the message history for a conversation
* Send an ad-hoc email, Slack, or Microsoft Teams notification to org users

**Example prompts:**

> *"Post an update on the SOC 2 evidence request thread saying the doc is uploaded."* *"What's been discussed on this control's thread?"* *"Notify the security channel that the pentest report is ready."*

#### Custom Attributes

Define and manage custom fields on Sprinto entities to capture org-specific metadata.

**What you can do:**

* Create new custom attribute (custom field) definitions for supported entity types
* Update existing custom field definitions
* Set or update custom field values on specific entities (vendors, risks, and more)

**Example prompts:**

> *"Add a custom field called 'Data Classification' to the vendor entity."* *"Update the 'Business Owner' custom field for vendor Acme Corp to Jane Doe."*

#### Employees & Users

Manage staff members, their roles, onboarding and offboarding, scope status, and background checks.

**What you can do:**

* Create new staff members and trigger onboarding, including org-wide onboarding configuration
* Start offboarding for departing employees
* Send onboarding reminders to specific staff
* Record manual background-check reports
* Update a user's in-scope/out-of-scope status and reporting structure
* Create custom staff roles and manage system-group membership
* Query users by role, system group, manager, scope status, or email — including active, offboarded, admin, and non-admin/non-infosec segments
* Get headcounts: active users, active in-scope users, offboarded users, total users

**Example prompts:**

> *"Add a new staff member: Jane Doe,* [*jane@example.com*](mailto:jane@example.com)*."* *"Start offboarding for* [*john@example.com*](mailto:john@example.com)*."* *"How many active in-scope users do we have?"* *"Who are the people managers in our org?"* *"Show me all users who are not admins and not in the infosec group."*

#### Employee Groups

View and manage employee groups, their members, and the HR/directory sources that populate them.

**What you can do:**

* List all employee groups and their members, including a preview of who would match a custom group rule
* View employee groups by provider source (e.g., Google Workspace, Okta)
* Query relations, memberships, and deduplicated user sets across groups
* Get group counts broken down by source

**Example prompts:**

> *"List all employee groups in our org."* *"Which users are in the Engineering group?"* *"What HR integrations are we using as sources for employee groups?"* *"How many employee groups do we have from each source?"*

#### Endpoints & Devices

Track and manage staff device (endpoint) records and connected MDM providers.

**What you can do:**

* Update endpoint records for staff devices (compliance status, ownership, etc.)
* View full detail for a specific staff device
* List all enrolled staff devices and connected MDM providers

**Example prompts:**

> *"Update the endpoint record for John's MacBook to mark it as compliant."* *"List all devices enrolled through our MDM."*

#### Evidence & Evidence Requests

Upload, track, and query manual evidence files and evidence requests across your compliance program.

**What you can do:**

* Create org-level manual evidence records from external file links
* Attach custom evidence to monitors and controls
* Create, update, or archive evidence requests — individually or in bulk — and notify participants
* Update the review status of evidence, individually or in bulk
* List all uploaded manual evidence and view request counts (total vs. archived)
* List which control checks have evidence attached

**Example prompts:**

> *"List all manual evidence files uploaded in the last 30 days."* *"How many evidence requests are currently open?"* *"Attach this evidence file to the encryption-at-rest monitor."* *"Create an evidence request for our Q3 access review and assign it to the security team."*

#### Findings

Create and manage findings linked to audits, vendors, controls, or risk items.

**What you can do:**

* Create new findings under any parent entity (audit, vendor, control, risk item)
* Update existing findings with new information
* View finding details and get total finding counts, optionally scoped to a parent entity

**Example prompts:**

> *"Create a new finding under our SOC 2 audit for a missing access control policy."* *"Update the finding on vendor Acme Corp to mark it as remediated."* *"How many open findings do we have across all vendors?"*

#### Frameworks

Enable, configure, and manage compliance frameworks and their criteria (principles) within your organization.

**What you can do:**

* List all active, eligible, and unfiltered compliance frameworks
* Enable or disable frameworks for your org
* Create a custom framework from scratch, or parse one directly from an uploaded document
* Add, enable, disable, and update framework criteria (principles), including audit justification text
* Map controls to framework principles and org frameworks
* View per-framework control setup/readiness counts and check-health summaries
* See how many framework criteria are mapped to controls

**Example prompts:**

> *"Which compliance frameworks are we currently working toward?"* *"Enable the ISO 27001 framework for our org."* *"Create a custom framework from this regulatory document."* *"How many SOC 2 criteria are not yet mapped to controls?"* *"Show me the check-health summary across all our active frameworks."*

#### Incidents

Track and manage security and operational incidents, update their severity, and close them individually or in bulk.

**What you can do:**

* List all incidents with filtering options, and see the available filter values
* Close single or multiple incidents in bulk
* Update incident severity and data-loss/customer-impact details
* View connected incident sources and incident-management providers
* List incidents self-reported by staff

**Example prompts:**

> *"List all open high-severity incidents."* *"Close all resolved incidents from last month."* *"Update the severity of incident #42 to Medium."* *"What incidents have customer data impact?"*

#### Infrastructure

View and classify your cloud infrastructure resources across connected providers like AWS, GCP, and Azure.

**What you can do:**

* List all connected cloud/infrastructure providers
* View active infrastructure resources and the distinct resource types present
* Update the classification of an individual infrastructure entity, or bulk-classify Security Hub/infra entities
* Update the smart default classification for a provider

**Example prompts:**

> *"List all connected cloud infrastructure providers."* *"Show me all unclassified infrastructure resources."* *"Classify our production EC2 instance as in-scope."* *"What infrastructure resource types do we have across our AWS account?"*

#### Knowledge Hub & Cross-Entity Search

Search across your organization's uploaded documents and previously approved answers, and run general-purpose Sprinto lookups without knowing the exact tool name.

**What you can do:**

* Search the Knowledge Hub for relevant documents and approved Q\&A pairs
* Auto-answer a batch of questions using the Knowledge Hub
* Look up available Sprinto operations or read-queries by describing what you need in plain English

**Example prompts:**

> *"Search our Knowledge Hub for anything about incident response timelines."* *"Auto-answer these 20 questionnaire rows from what we already have on file."*

#### Pentests

Manage penetration tests, vulnerabilities, and reports within your compliance program.

**What you can do:**

* List all pentests and their statuses, and get an org-wide pentest overview
* View pentest vulnerabilities across the organization
* Create vulnerabilities for a given pentest report
* Retrieve the latest report for a specific pentest

**Example prompts:**

> *"List all our penetration tests."* *"Show me all open vulnerabilities from our last pentest."* *"What is the latest report for our Q1 2025 pentest?"*

#### Policies

Create, update, approve, and manage your organization's compliance policies and policy documents.

**What you can do:**

* Create new custom policies — editable, user-authored, or uploaded documents
* Update policy draft content and document details (owner, reviewer, etc.)
* Send policies for approval and/or approve them; mark approvals obtained outside Sprinto
* Upgrade a Sprinto-managed policy to a newer version
* Enable or disable policy types for your org
* Upload policy documents from external sources
* Notify policy reviewers directly
* View policy content, version history, drift reports, gap analysis, and branding config
* View policies by type, by register, and get a signed download/preview URL (Markdown or PDF) for any policy or template
* Search policy content by keyword across name, type, and description

**Example prompts:**

> *"Which policies are currently in draft and not yet approved?"* *"Show me our policy gap analysis."* *"Send review notifications to all policy reviewers."* *"Approve the Access Control Policy."* *"List all policies in our Information Security policy register."* *"Which policies have drifted from their expected state?"*

#### Policy Exceptions

Request, grant, and track exceptions to policy requirements across your organization.

**What you can do:**

* Create a new policy exception and notify the assigned analyst
* List all policy exceptions org-wide, or scoped to the current user
* Retrieve a specific policy exception by ID, and get the total exception count

**Example prompts:**

> *"How many policy exceptions do we currently have?"* *"List all active policy exceptions in our org."* *"Show me the policy exceptions assigned to me."* *"Grant an exception to the password rotation policy for the DevOps team, expiring in 90 days."*

#### Risks

Create, import, assess, and manage risks in your organization's risk register.

**What you can do:**

* Create custom org risk items, or bulk-import/bulk-update risk records
* Approve, update, and map risks to entities; add mitigating notes
* Create or complete a risk assessment, and pull the latest completed snapshot
* Update org risk profiles, categories, and custom rating scales
* View all risks with filtering, plus untreated risks with no selected treatment plan
* See risk score formulas, heatmap distribution, and aggregate risk reporting
* View which controls or assets are mapped to mitigate a given risk

**Example prompts:**

> *"List all high-rated risks in our risk register."* *"Create a new risk for third-party vendor data exposure."* *"Which controls are mapped to mitigate our data breach risk?"* *"What is our risk scoring formula?"* *"Show me all untreated risks."* *"Approve the pending risk items in our register."*

#### Security Questionnaires

Import, answer, and manage security questionnaires — including vendor-facing and AI-system assessments.

**What you can do:**

* Import a security questionnaire from an uploaded file (Excel, CSV, Word, PDF) and classify its columns
* Trigger automatic question extraction and answer generation from the Knowledge Hub
* Bulk-approve questions, and bulk-reassign owner or reviewer
* Create or update auto-response Q\&A pairs in the Knowledge Hub
* View questionnaire items grouped by domain, for both vendor and AI-system questionnaires
* Create or update a reusable vendor questionnaire template

**Example prompts:**

> *"Import this security questionnaire and generate answers from our Knowledge Hub."* *"Show me all unanswered questions in our current vendor questionnaire."* *"Bulk-approve all questions in section 3 of the questionnaire."* *"Add a new auto-response answer for MFA questions to our Knowledge Hub."*

#### Tasks

Create, assign, update, and close compliance tasks and workflow actions across your org.

**What you can do:**

* Create new custom tasks tied to vendor and risk workflows
* Update task details and close completed tasks
* Approve or reject a workflow node action (e.g., an approval step in a review chain)
* Mark a task as approved when the approval happened outside Sprinto
* List tasks assigned to you, tied to a specific entity, or across the org

**Example prompts:**

> *"List all my open compliance tasks."* *"Create a task to collect the latest SOC 2 report from Vendor X."* *"Close task #15 — it's been completed."* *"Show me all tasks tied to our Acme Corp vendor record."*

#### Training & Policy Acknowledgements

Track staff completion of security training and policy read-and-acknowledge requirements, including training synced from external LMS platforms.

**What you can do:**

* Create a policy or training acknowledgement batch and notify assigned staff
* Send reminders to staff with pending policy acknowledgements
* View acknowledgement rate for a policy type, and staff-level acknowledgement status
* List training requirements, connected training providers, and external training campaigns
* View per-user training and onboarding-training completion status

**Example prompts:**

> *"What's our acknowledgement rate for the updated Acceptable Use Policy?"* *"Send reminders to everyone who hasn't acknowledged the new policy yet."* *"Which employees haven't completed onboarding security training?"* *"List our connected training providers."*

#### Vendors

Manage your vendor register end-to-end — from discovery and onboarding to risk assessment, documents, and due diligence.

**What you can do:**

* Add single or multiple vendors; bulk-import a full vendor list
* Update vendor details and risk-factor scores across configured risk dimensions
* Submit vendor due-diligence assessments and view outstanding due-diligence checklist items
* Create, reactivate, or list vendor integration connections
* Request, upload, name, and track expiry for vendor documents; view combined document/request summaries
* View vendor risk assessments, live risk pulse (by website URL), and risk-level distribution across the register
* Discover vendors suggested by connected integrations (e.g., Google Workspace), dismiss suggestions, and review decisioning info
* Search the external Sprinto vendor catalog for pre-built profiles
* View vendor onboarding/intake requests and default register/admin configuration
* Get aggregate vendor reporting: overview stats, total counts, and Sprinto auto-collected document counts

**Example prompts:**

> *"List all active vendors in our org."* *"Which vendors don't have a completed due diligence assessment?"* *"Add Acme Corp as a new vendor with High data sensitivity."* *"Show me the risk pulse for vendor stripe.com."* *"What new vendors has Sprinto suggested from our Google Workspace?"* *"Send a document upload request to Acme Corp for their SOC 2 report."* *"How many vendor documents has Sprinto auto-collected for us?"*

#### Vulnerability Management

Track vulnerability scanning coverage and results separately from pentest-specific findings.

**What you can do:**

* Register vulnerability-scanning providers for the org
* List connected vulnerability-scanning providers and the entities they track
* View vendor-side (infrastructure/container/SCA) vulnerabilities detected through connected scanners

**Example prompts:**

> *"What vulnerability scanning providers are connected to our org?"* *"Show me all critical vulnerabilities flagged on our production infrastructure."*

### 4. Support

The capabilities listed in this documentation reflect what is available today, and we are actively expanding what you can do — including deeper workflow automation, richer reporting, and support for more Sprinto entities.

If you run into any issues, unexpected behavior, or have feedback on what you'd like to see next, reach out to us at [**support@sprinto.com**](mailto:support@sprinto.com). We'd love to hear from you.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.sprinto.com/sprinto-ai/sprinto-mcp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.