Skip to content
Declara
⌘K
engineercompliance-owner

Connect an AI assistant

Was this page helpful?

Declara runs a Model Context Protocol (MCP) server. An assistant that speaks MCP can connect to it with an API key and answer questions from your workspace, such as "which cases have a deadline this week?" or "is release 4.2.0 blocked?". It reads the same data the REST API returns.

The server is read-only. It has no tool that creates, changes or files anything. An assistant can tell you a deadline. It cannot submit a report or change a triage decision.

Before you start

  • The Growth or Partner plan. The MCP server uses API keys, which are part of the integrations entitlement.
  • The owner or an admin role, to create the key. What the assistant can read then depends on the key's scopes, not on your role.

Generate an API key for the assistant. Do not reuse your CI pipeline's key. A separate key can be revoked on its own, and its calls are counted separately.

The key needs products:read to connect at all. Add the other scopes for the tools you want the assistant to use:

ToolWhat it returnsScope
list_productsProducts, versions, support end dates and whether each version has an SBOMproducts:read
get_vexA product's VEX document, as OpenVEX or CycloneDXproducts:read
get_release_gateWhether a version ships a known exploited vulnerability: pass, blocked or pending (Annex I Part I(2)(a))products:read
get_support_statusThe product's support period and each version's effective end date (Art. 13(8))products:read
list_alertsAlerts, open ones by defaultalerts:read
list_casesArticle 14 cases with their deadlines and submission timescases:read
get_case_deadlinesOne case's legal deadlines, each with its article citationcases:read
list_security_advisoriesYour own security advisories and their CSAF documentscases:read

If the key lacks a tool's scope, that tool refuses and names the missing scope. The other tools keep working.

Steps

  1. Add a remote MCP server in your assistant's settings. The endpoint is:

    https://your-declara-host/api/mcp

  2. Send the key as a bearer token in the Authorization header. Clients that accept a JSON server list use a shape like this:

    {
  "mcpServers": {
    "declara": {
      "url": "https://your-declara-host/api/mcp",
      "headers": {
        "Authorization": "Bearer dcl_your_key_here"
      }
    }
  }
}

    Clients that only run local (stdio) servers can connect through mcp-remote, passing the same header.

  3. Ask the assistant to list its Declara tools. You should see the tools from the table above.

What you should see

The server uses stateless Streamable HTTP and keeps no session. A request without a key, or with an unknown, revoked or expired key, gets the same 401 the REST API returns. A key without products:read, or a key for a closed workspace, gets 403. Every request counts as one call against the key's usage in Settings → API.

A few answers are deliberately narrow:

  • Deadlines are the legal ones, as stored. get_case_deadlines returns the deadlines held on the case, the same values list_cases and the REST API return, with the early warning, notification and final report citations from Art. 14(2) or 14(4). It does not return the 48-hour figure the Single Reporting Platform currently displays. See How the reporting clock works.
  • Drills are not there. A practice case does not appear in list_cases, and get_case_deadlines answers "Not found" for it.
  • Another workspace's id looks missing. An id from another workspace gets "Not found", the same answer as an id that does not exist.
  • An alert is not a filing. Each alert carries a note that it is a reason to assess, not a reportable event.

Related