{
  "$schema": "https://modelcontextprotocol.io/schemas/server-card/v1.0",
  "version": "1.2",
  "protocolVersion": "2025-06-18",
  "serverInfo": {
    "name": "matproof",
    "title": "Matproof",
    "version": "2.0",
    "description": "Read and update a Matproof compliance programme: frameworks and their requirements, controls, policies, tasks, vendors, risks, evidence links and overall compliance status. Scoped to one organisation by the credential that connects.",
    "homepage": "https://matproof.com/developers",
    "documentation": "https://docs.matproof.com/api-reference/authentication",
    "vendor": "VantarGroup LLC"
  },
  "transport": {
    "type": "streamable-http",
    "url": "https://api.matproof.com/v1/mcp"
  },
  "capabilities": {
    "tools": true,
    "resources": false,
    "prompts": false
  },
  "tools": [
    {
      "name": "list_frameworks",
      "title": "List frameworks",
      "description": "List the compliance frameworks enabled for the caller's organization, with their pinned version."
    },
    {
      "name": "get_framework_requirements",
      "title": "Get framework requirements",
      "description": "Get the requirements of one framework and the controls linked to each. Pass the framework id returned by list_frameworks. Paged."
    },
    {
      "name": "list_controls",
      "title": "List controls",
      "description": "List the controls in the caller's organization with their review dates. Paged."
    },
    {
      "name": "list_policies",
      "title": "List policies",
      "description": "List the policies in the caller's organization with their publish status and version. Paged."
    },
    {
      "name": "list_tasks",
      "title": "List tasks",
      "description": "List the tasks in the caller's organization, optionally filtered by status. Paged."
    },
    {
      "name": "list_vendors",
      "title": "List vendors",
      "description": "List the vendors in the caller's organization with assessment status and DORA criticality. Paged."
    },
    {
      "name": "list_risks",
      "title": "List risks",
      "description": "List the risk register for the caller's organization, optionally filtered by status. Paged."
    },
    {
      "name": "get_compliance_status",
      "title": "Get compliance status",
      "description": "Roll-up of the caller's compliance posture: a score per framework plus an org-wide average."
    },
    {
      "name": "get_control",
      "title": "Get control",
      "description": "One control with the requirements it maps to, its policies and their publish status, its tasks and its evidence. The answer to why a control is not satisfied."
    },
    {
      "name": "get_policy",
      "title": "Get policy",
      "description": "One policy in full, rendered as markdown, so an answer can quote what the policy actually says."
    },
    {
      "name": "get_task",
      "title": "Get task",
      "description": "One task with its description, its controls, and whether it requires evidence before it can be closed."
    },
    {
      "name": "list_evidence",
      "title": "List evidence",
      "description": "The evidence submissions. This is where the evidenceSubmissionId that link_evidence needs comes from. Paged."
    },
    {
      "name": "update_task_status",
      "title": "Update task status",
      "description": "Update the status of a task. A task that requires evidence cannot be set to done until an attachment is uploaded.",
      "write": true,
      "scope": "task:update"
    },
    {
      "name": "create_comment",
      "title": "Create comment",
      "description": "Add a comment to a task, policy, vendor or risk.",
      "write": true,
      "scope": "task:create"
    },
    {
      "name": "link_evidence",
      "title": "Link evidence",
      "description": "Link an evidence submission to a control, optionally scoped to one requirement.",
      "write": true,
      "scope": "evidence:create"
    }
  ],
  "pagination": {
    "parameters": ["limit", "offset"],
    "defaultLimit": 100,
    "maxLimit": 500,
    "description": "Every list tool is paged. Responses carry count, offset, limit, hasMore and nextOffset. Pass nextOffset back as offset to read the next page."
  },
  "toolPolicy": "This is a hand-picked tool set for agents, not a generated mirror of the REST API. Tools are added when an agent has a reason to call them, so the list stays short enough to reason about. Call tools/list for the authoritative set your credential can reach; the three write tools appear only when the credential carries the scope named above.",
  "auth": {
    "required": true,
    "methods": [
      {
        "type": "oauth2",
        "authorizationServer": "https://app.matproof.com",
        "metadata": "https://app.matproof.com/.well-known/oauth-authorization-server",
        "protectedResourceMetadata": "https://api.matproof.com/.well-known/oauth-protected-resource",
        "dynamicClientRegistration": true,
        "pkce": "S256"
      },
      {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key",
        "description": "Organisation API key, generated in the app under Settings, then API keys."
      }
    ]
  },
  "related": {
    "restApi": "https://api.matproof.com/v1",
    "openapi": "https://docs.matproof.com/openapi.json",
    "description": "The REST API is a separate and much larger surface. The tools above are not generated from it and do not mirror it. Use the API for integrations, the tools for agents."
  },
  "contact": "malte@matproof.com"
}