Connect Claude and other AI assistants (MCP)

Aegis runs a Model Context Protocol (MCP) server. Once connected, an AI assistant can answer questions like "which SOC 2 controls are still missing evidence?" or "draft answers for the unanswered questions in this vendor questionnaire", and, if you allow it, update tasks, risks and trust portal requests for you, or propose answers to your security assessment for a person to confirm.

The server address is:

https://api.nexusvoidhq.com/v1/mcp

You can find it, with copy buttons, under Settings → API Keys → Connect to Claude.

Access is never more than yours

A connection always acts as the person who made it, inside one organization.

• It can see and do only what your role allows in Aegis. An auditor's connection is read-only; an employee's connection sees the policies and tasks assigned to them and nothing else.
• Permissions are checked on every call against your current role. If your role is narrowed, the connection narrows with it. If you are removed from the organization, it stops working.
• Tools you don't have permission for are not even shown to the assistant.

Connecting

claude.ai

Claude Code

Run:

claude mcp add --transport http aegis https://api.nexusvoidhq.com/v1/mcp

Then run /mcp inside Claude Code and choose aegis to sign in in your browser.

Other clients (API key)

Clients that don't support sign-in can use an API key. Create one under Settings → API Keys (it can only carry permissions you hold yourself) and send it as a header:

{
  "mcpServers": {
    "aegis": {
      "url": "https://api.nexusvoidhq.com/v1/mcp",
      "headers": { "x-api-key": "<your API key>" }
    }
  }
}

What the assistant can do

Read

Change (only if your role allows it)

Every change tool has a dry run that shows exactly what would change, and assistants are told to confirm with you before making a change. Claude asks for your approval before running any of them.

Answer the assessment with your agent

An assistant can help fill in your security assessment from what you tell it, from your Document Vault, and from connected systems. Open Answer with your agent in the assessment to connect it and to watch what it sends.

The contract

Every assessment tool, and the server's own instructions, carry the same sentence:

Never answer from general knowledge about the company. If the user has not told you and no connected source says it, call mark_assessment_unknown.

An assistant that doesn't know an answer is expected to say so, not guess. "Couldn't answer" items show up in the assessment for a person to answer.

Nothing counts until a person confirms it

• Every answer an assistant sends is stored as a pending suggestion, never as an answer. It has no effect on the assessment, your scope, program generation or the roadmap until a signed-in person confirms it in Aegis.
• A person can confirm, edit or reject each suggestion, or a whole section at once.
• There is no submit tool and no confirm tool. Only a person can confirm answers or submit the assessment, and the assessment's REST endpoints refuse API keys for those actions.
• Pending suggestions are discarded when the assessment is submitted.

The rules the server enforces

Each proposal is checked on the server. A rejection starts with the rule it broke, so the assistant can tell what to fix.

The assistant also says where each answer came from (you told it, a document, an integration, or its own inference), and inferred answers are flagged for the person reviewing them.

Both write tools support a dry run and share a limit of 60 calls a minute.

Who gets the assessment tools

API keys can carry the Security Assessment read and update scopes (assessment:read, assessment:update). As always, a key never has more access than its creator holds now. With assessment:update, a key's assistant can propose answers; it still cannot confirm or submit.

get_assessment_state starts the assessment if your organisation has not opened it yet. When the connection can read the Vault, it also lists the analysed Vault documents the assistant may cite.

Audit trail

Every call, read or write, is recorded in the organization's audit log as you, with the tool name and its arguments (anything that looks like a secret is redacted). Changes also appear in the activity of the task, risk or request they touched.

Disconnecting

Settings → API Keys → Connected apps lists the assistants connected to your organization. Disconnect revokes access immediately. Owners and admins see and can disconnect everyone's connections; everyone else sees their own. API keys are revoked from the same page.

Limits and what it does not do

• It works on one organization per connection. Connect again to use another.
• It does not upload evidence files, edit policy text, or delete anything.
• It cannot confirm assessment answers or submit the assessment, and it cannot upload to or search the Document Vault.
• It does not return evidence file contents, secrets, credentials or access tokens.
• Results are paginated and capped in size; ask for a narrower list if an answer is cut short.
• Calls are limited to 120 a minute per connection, answer_security_question to 20 a minute, and the two assessment write tools to 60 a minute between them.
• Answers drafted by answer_security_question come from your own policies and knowledge base. Review them before sending them to a customer; when there is no supporting evidence it says so instead of guessing.