Developers · API · MCP
The Matproof API
Matproof is a compliance management platform. Everything the app shows a person, the API returns as JSON: frameworks and their requirements, controls, policies, tasks, vendors, risks, evidence and findings. A hosted MCP server exposes the same data to an AI agent as tools, so an agent can read a compliance programme without anyone building an integration first.
https://api.matproof.comMCP https://api.matproof.com/v1/mcpREST API
The API is versioned under /v1 and speaks JSON. Every operation is described in the OpenAPI document, which carries a unique operation ID, typed parameters and a response schema for each one. That is the file to feed to a client generator or to an LLM function-calling layer.
curl https://api.matproof.com/v1/frameworks \ -H "X-API-Key: $MATPROOF_API_KEY"
OpenAPI document: matproof.com/openapi.json. Reference documentation: docs.matproof.com.
Authentication
Two ways in, both scoped to one organisation.
Organisation API key. Send it as X-API-Key. Generate it in the app under Settings, then API keys. Keys are stored hashed, so the plaintext is shown once and cannot be read back.
OAuth 2.0. For per-user access, including MCP clients. The authorization server is app.matproof.com and publishes RFC 8414 metadata at /.well-known/oauth-authorization-server. The API publishes RFC 9728 protected-resource metadata at api.matproof.com/.well-known/oauth-protected-resource. Dynamic client registration and PKCE with S256 are supported, so a client can register itself and complete the flow without a pre-shared secret.
Both discovery documents are also reachable through matproof.com, which redirects to the issuer that owns them.
MCP server
Matproof runs a hosted Model Context Protocol server over Streamable HTTP. Fifteen tools, hand-picked for what an agent has a reason to call. It is not generated from the REST API and does not mirror it, so the list stays short enough for a model to reason about.
| Tool | Returns or does |
|---|---|
list_frameworks | The frameworks enabled for the organisation, with their pinned version. |
get_framework_requirements | The requirements of one framework and the controls linked to each. |
list_controls | The controls, with their review dates. |
list_policies | The policies, with publish status and version. |
list_tasks | The tasks, filterable by status. |
list_vendors | The vendors, with assessment status and DORA criticality. |
list_risks | The risk register, filterable by status. |
get_compliance_status | A score per framework and an organisation-wide average. |
get_control | One control with its requirements, policies, tasks and evidence. Why a control is not satisfied. |
get_policy | One policy in full, as markdown, so an answer can quote it. |
get_task | One task, including whether it needs evidence before it can close. |
list_evidence | The evidence submissions, and the id link_evidence needs. |
update_task_status | Moves a task. A task that requires evidence cannot reach done without an attachment. Needs the task:update scope. |
create_comment | Adds a comment to a task, policy, vendor or risk. Needs the task:create scope. |
link_evidence | Links an evidence submission to a control, optionally to one requirement. Needs the evidence:create scope. |
Every list tool is paged: 100 rows by default, 500 at most, with a nextOffset for the rest. Call tools/list for the authoritative set. The three write tools appear only when the credential carries the scope beside them.
npx mcp-remote https://api.matproof.com/v1/mcp \ --header "X-API-Key: $MATPROOF_API_KEY"
Clients that speak OAuth can connect to the same URL with no key at all: discovery, registration and login happen in the browser. The manifest at /.well-known/mcp.json describes the endpoint, the transport and the auth options.
Reading this site as an agent
Ask for markdown and you get markdown. The pages listed in llms.txt, and every blog article, are served as text/markdown when the request prefers it. The response carries Vary: Accept, so a shared cache cannot hand you the wrong representation.
curl -H "Accept: text/markdown" https://matproof.com/pricing
A path that does not exist returns a real 404, in markdown when you asked for markdown, with links back to the site index.
Every machine-readable file
- OpenAPI document
Every operation the REST API serves, with an operation ID, typed parameters and response schemas.
- API reference
Authentication, resources and worked examples.
- MCP manifest
Where the hosted MCP server is, which transport it speaks and how it authenticates.
- OAuth authorization server metadata
RFC 8414 metadata for the issuer, app.matproof.com.
- OAuth protected resource metadata
RFC 9728 metadata for the API, api.matproof.com.
- Instructions for agents
When to use this site, when not to, how to cite it, and how to call the API.
- llms.txt
Index of this site written for language models.
- llms-full.txt
Every price, coverage claim and correction, in one file.
- Sitemap
Every URL this site serves.
- security.txt
Where to report a vulnerability.
- Sealed Evidence Bundle spec
The open evidence export format, CC BY 4.0.
What does not exist yet
There is no official Matproof CLI and no published SDK package. Generate a client from the OpenAPI document, or use the MCP server, which is the supported path for AI agents.
Questions: malte@matproof.com or the contact form.