Example build · MCP catalog
A catalog that lets approved AI assistants use your security tools safely.
AI assistants are more useful when they can reach real tools and data, and more risky for the same reason. We built a catalog on the Model Context Protocol (MCP), an open standard for connecting assistants to tools, so security decides which assistants can use which tools, and what they may do.
A catalog entry
Example- Tool
- A security tool your team already uses
- What assistants may do
- Read findings. No changes.
- Who may use it
- Approved assistants, for the security team
- Credential
- Held by the catalog, never by the assistant
- Every use
- Recorded for review
The situation
Teams want assistants to use security tools, and nobody wants them given the keys.
People already use AI assistants to ask about vulnerabilities, vendors and risks. The answers are better when the assistant can read the real data. The usual way to get there is to paste in an access token, which gives the assistant more access than anyone intended and leaves no record of what it did.
The Model Context Protocol gives assistants a standard way to connect to tools. A standard connection is not a safe one by itself. Someone still has to decide what is exposed, to which assistant, and what is recorded.
We built that layer as a catalog. It is scoped as its own project, apart from the managed program.
What we built
What we built, in order.
The tools and their data stay where they are. The catalog sits between them and the assistants, and applies the rules.
Approve · Person
Security chooses a tool and decides what an assistant may do with it.
Connect · Rules in code
Connect the tool to the catalog through a standard connector, with its own credential.
Control · Rules in code
Apply written access rules: which assistants, which people, read or act.
Use · AI step
An approved assistant asks the catalog for a tool and uses the result to help.
Review · Person
Security reviews the record of use and tightens or widens access.
What changed
Assistants can use real security data, and security can see how.
Teams get the benefit of connected assistants without handing out broad access, and security gets a single place to set the rules and a record to review. We have no before-and-after figures to publish.
- Security team
- Uses approved assistants against real tool data instead of pasting exports into a chat.
- Security lead
- Decides what is exposed, to whom, and reviews how it is used.
- Vectra View
- Builds it as a scoped project. Adding a tool to the catalog later is scoped with you.
Have a process like this?
Tell us which review or routing step your team repeats and we will tell you whether it is a good fit.