Skip to main content
Version: 1.6.1

Integrate TRON.ASOC with MCP clients

The system supports the MCP (Model Context Protocol)—a standard for interaction between AI agents and external tools and data. TRON.ASOC acts as an MCP server and gives AI agents access to functions for managing vulnerabilities, scans, projects, and other system entities.

Implementation details:

  • Protocol: JSON-RPC 2.0;
  • Data transfer: Streamable HTTP (primary), SSE (legacy).

Requirements​

Before you start, make sure that:

  • TRON.ASOC version 1.6 is installed on your workstation;
  • a compatible MCP client, such as Claude Code or Cursor, is installed on your workstation;
  • your TRON.ASOC account has an API token with the required permissions. For more information about creating an API token, see Create an API token.

Authentication​

To connect to the TRON.ASOC MCP server, use the X-API-Token header with a valid user API token.

The roles and policies of the user who makes the request determine access to the tools.

Server configuration​

Configure the MCP server in the config.yml file:

mcp:
  enabled: true
  tools: \[]  # пустой массив = все инструменты включены

To restrict the available tools, specify their names in the tools array:

mcp:
  enabled: true
  tools:
    - asoc\_list\_projects
    - asoc\_get\_project
    - asoc\_list\_issues

Connect an MCP client​

This section explains how to connect the Claude Code MCP client.

Follow these steps to connect an MCP client:

  1. Create or edit the \~/.claude/mcp.json file:
{
  "mcpServers": {
    "asoc": {
      "type": "http",
      "url": "https://<asoc-host>/mcp",
      "headers": {
        "X-API-Token": "<ваш-api-токен>"
      }
    }
  }
}
  1. Test the connection with curl:
TOKEN="<ваш-api-токен>"
URL="https://<asoc-host>/mcp"

# 1. Инициализация сессии
SESSION=$(curl -s -D - -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' \\
  | grep -i "Mcp-Session-Id" | awk '{print $2}' | tr -d '\\r')

# 2. Подтверждение готовности клиента
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}'

# 3. Получение списка инструментов
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

# 4. Вызов инструмента
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"asoc\_list\_projects","arguments":{}}}'

Available MCP tools​

The tables below list MCP tools that you can use to work with system entities, for example, create a project or layer, change a vulnerability status, or start a scan.

Projects​

ToolPurposeSystem permissions
asoc\_list\_projectsGet a list of projectsView projects
asoc\_get\_projectGet a specific projectView projects
asoc\_create\_projectCreate a projectCreate and edit projects

Layers​

ToolPurposeSystem permissions
asoc\_get\_project\_layer\_treeGet the project layer hierarchyView layers
asoc\_list\_layersGet a list of layersView layers
asoc\_get\_layerGet layer information by IDView layers
asoc\_create\_layerCreate a layerCreate and edit layers

Vulnerabilities​

ToolPurposeSystem permissions
asoc\_list\_issuesGet a list of vulnerabilitiesView security issues
asoc\_get\_issueGet vulnerability information by IDView security issues
asoc\_update\_issue\_statusChange the vulnerability statusUpdate security issues
asoc\_get\_issue\_statusesGet vulnerability statuses—
asoc\_group\_update\_statusChange the status of multiple vulnerabilitiesUpdate security issues
asoc\_group\_update\_severityChange the severity of multiple vulnerabilitiesUpdate security issues
asoc\_assign\_issueAssign a person responsibleAssign a person responsible
asoc\_get\_issue\_characteristicsGet vulnerability severity levels—
asoc\_get\_commentsGet commentsView comments
asoc\_add\_commentAdd a commentComment
asoc\_delete\_commentDelete a commentDelete comments
asoc\_get\_mentionsGet mentions of the current user—
asoc\_mark\_mentions\_readMark mentions as read—
asoc\_mark\_comments\_readMark comments as readView comments

Scans​

ToolPurposeSystem permissions
asoc\_list\_scansGet a list of scansView security checks
asoc\_get\_scanGet scan informationView security checks
asoc\_stop\_scanStop a scanManage security checks
asoc\_list\_scan\_filtersGet scan filtersView security checks
asoc\_compare\_scansCompare two scansView security checks

Security checks​

ToolPurposeSystem permissions
asoc\_create\_checkCreate a security checkManage security checks
asoc\_get\_checkGet security check informationView security checks
asoc\_run\_checkRun a security checkRun security checks

Statistics​

ToolPurposeSystem permissions
asoc\_stats\_openGet data about open vulnerabilitiesView security issues
asoc\_stats\_allGet overall statisticsView security issues
asoc\_stats\_severityGet severity statisticsView security issues
asoc\_stats\_toolGet tool statisticsView security issues
asoc\_stats\_projectGet project statisticsView security issues
asoc\_stats\_vulnerabilityGet CWE/CVE statisticsView security issues

Quality gates​

ToolPurposeSystem permissions
asoc\_list\_gatesGet a list of quality gatesView quality gate templates
asoc\_get\_gateGet quality gate dataView quality gate templates
asoc\_get\_gate\_status\_for\_layerGet the quality gate status for a layerView quality gate templates
asoc\_get\_gate\_status\_for\_checkGet the quality gate status for a security checkView quality gate templates
asoc\_create\_gateCreate a quality gateManage quality gate templates
asoc\_attach\_gate\_to\_checkAttach a quality gate to a security checkManage quality gate templates
asoc\_create\_conditionCreate a quality gate conditionManage quality gate templates

Users​

ToolPurposeSystem permissions
asoc\_list\_usersGet a list of users—
asoc\_get\_userGet user data by ID—
asoc\_get\_current\_userGet data about the current user—
asoc\_list\_user\_api\_tokensGet a list of the user's API tokens—
asoc\_delete\_api\_tokenDelete an API token—

Task trackers​

ToolPurposeSystem permissions
asoc\_list\_trackersGet a list of configured trackersView trackers
asoc\_get\_trackerGet tracker informationView trackers
asoc\_sync\_tracker\_taskSync with a tracker taskCreate tasks for trackers
asoc\_unlink\_tracker\_taskUnlink a tracker taskCreate tasks for trackers

SBOMs and dependencies​

ToolPurposeSystem permissions
asoc\_list\_sbomsGet a list of SBOM filesView dependencies
asoc\_list\_dependenciesGet a list of dependenciesView dependencies
asoc\_get\_dependencyGet dependency dataView dependencies

FP analysis​

ToolPurposeSystem permissions
asoc\_fp\_analyzeRun FP analysisWork with FP analysis
asoc\_fp\_get\_analysisGet the FP analysis resultWork with FP analysis

Other tools​

ToolPurposeSystem permissions
asoc\_list\_reportsGet a list of reportsView reports
asoc\_list\_severitiesGet data about severity levels—
asoc\_list\_toolsGet a list of toolsView tools
asoc\_create\_toolCreate a toolCreate and edit tools
asoc\_update\_toolUpdate a toolCreate and edit tools
asoc\_list\_sourcesGet a list of sourcesView sources
asoc\_create\_sourceCreate a sourceCreate and edit sources
asoc\_update\_sourceUpdate a sourceCreate and edit sources
asoc\_visibility\_filterCheck access to entities—