AI tools (MCP)
Tradecraft runs an MCP server (Model Context Protocol) for each organization, so AI assistants such as Claude can use your approved security answers. Your server’s address is your organization’s Tradecraft address followed by /mcp.
AI tools are included in every plan, trials too. How many calls and proposals each person can make per minute, hour or day depends on the plan; admins can lower those limits in Admin → AI tools (MCP) → Settings → Rate limits.
Turn it on (admins)
Section titled “Turn it on (admins)”In Admin → AI tools (MCP) (tabs Settings, Who can connect, Connected apps, Usage, Setup):
- Turn on Allow AI tools to connect. It is off until an admin enables it.
- In Who can connect, choose which roles get Connect AI tools (OAuth) and Propose answers from apps and AI tools. By default reviewers, approvers and admins have both; users don’t. The same tab holds Connect apps to the API on my behalf, for apps that use the Tradecraft API.
Opt in (each person)
Section titled “Opt in (each person)”Each person must also opt in under Settings → Connected apps → Allow apps and AI tools to act for me. The same switch covers apps that use the Tradecraft API. Admins can’t opt in for someone else; turning it off disconnects all of that person’s apps and AI tools.
Connect an AI tool
Section titled “Connect an AI tool”Add the server address as a custom connector or remote MCP server in your AI tool. The tool sends you to Tradecraft to sign in and approve access (OAuth). You can see and revoke connected apps under Settings → Connected apps; admins can block apps for the organization.
Tested with Claude (claude.ai, Claude Desktop, mobile) and Claude Code. Other MCP clients that support OAuth should work but haven’t been verified.
One sign-in server for every organization
Section titled “One sign-in server for every organization”AI tools sign in through one OAuth authorization server for every organization, the same one the Tradecraft API uses: https://api.tradecrafthub.ai once it launches (until then, your Tradecraft address). Before, each organization had its own. Your MCP server address does not change, and neither do your organization’s settings, permissions or opt-ins.
What to do when your connection moves to the shared server:
- Tools that find the sign-in server themselves (Claude, Claude Code, ChatGPT, VS Code, Cursor): the next time the tool asks you to sign in, select Allow once more. Nothing else.
- Tools configured by hand with authorization and token URLs (for example Microsoft Copilot Studio’s manual OAuth): an admin replaces the authorization URL with
https://api.tradecrafthub.ai/oauth/authorize, and the token and refresh URLs withhttps://api.tradecrafthub.ai/oauth/token. This has not been verified with those tools yet.
The old per-organization sign-in addresses keep working, with Deprecation headers, until 90 days after the Tradecraft API launches; then they are removed and the connections that still use them must sign in again. The date is set at the launch, and from then on those addresses also send a Sunset header with it. Reconnect any tool that has not moved by then.
| Tool | What it does |
|---|---|
ask_security_question |
Answers a question from your approved knowledge, with sources |
search_approved_answers |
Searches approved answers |
get_answer_source |
Shows where an answer came from |
list_libraries |
Lists your organization’s libraries |
get_knowledge_gaps |
Lists open knowledge gaps |
propose_answer |
Proposes a new answer |
answer_knowledge_gap |
Proposes an answer to a gap |
suggest_answer_edit |
Proposes a change to an existing answer |
AI tools only ever read approved answers. Everything they write is a proposal that waits in the review queue, labelled MCP · tool name. They can’t approve, finalize or delete anything. Every call is recorded in the audit log.
Your AI tool’s provider receives the answers you retrieve, under your own agreement with that provider.