Skip to main content
Version: 1.6

Integrating TRON.ASOC with MCP clients

The system supports the MCP (Model Context Protocol)—a standard for enabling AI agents to interact with external tools and data. TRON.ASOC acts as an MCP server and provides AI agents with access to vulnerability, scan, project, and other system entity management functions.

Implementation characteristics:

  • Protocol: JSON-RPC 2.0;
  • Data transfer: Streamable HTTP (primary), SSE (legacy).

Requirements​

Before you start, make sure that:

  • TRON.ASOC version 1.6 is installed on your workstation;
  • a compatible MCP client, such as Claude Code or Cursor, is installed on your workstation;
  • an API token with the required permissions has been created for your TRON.ASOC account. For more information about creating an API token, see Create an API token.

Authentication​

To connect to the TRON.ASOC MCP server, use the X-API-Token header with a valid user API token.

The user's roles and policies determine access to tools for requests made on that user's behalf.

Server configuration​

Configure the MCP server in the config.yml file:

mcp:
  enabled: true
  tools: \[]  # пустой массив = все инструменты включены

To restrict the available tools, specify their names in the tools array:

mcp:
  enabled: true
  tools:
    - asoc\_list\_projects
    - asoc\_get\_project
    - asoc\_list\_issues

Connecting an MCP client​

This section describes how to connect the Claude Code MCP client.

Follow these steps to connect an MCP client:

  1. Create or edit the \~/.claude/mcp.json file:
{
  "mcpServers": {
    "asoc": {
      "type": "http",
      "url": "https://<asoc-host>/mcp",
      "headers": {
        "X-API-Token": "<ваш-api-токен>"
      }
    }
  }
}
  1. Verify the connection with curl:
TOKEN="<ваш-api-токен>"
URL="https://<asoc-host>/mcp"

# 1. Инициализация сессии
SESSION=$(curl -s -D - -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' \\
  | grep -i "Mcp-Session-Id" | awk '{print $2}' | tr -d '\\r')

# 2. Подтверждение готовности клиента
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}'

# 3. Получение списка инструментов
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

# 4. Вызов инструмента
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"asoc\_list\_projects","arguments":{}}}'

Available MCP tools​

The tables below list MCP tools for working with system entities, such as creating a project or layer, changing a vulnerability status, and starting a scan.

Projects​

ToolPurposeSystem user permissions
asoc\_list\_projectsGet a list of projectsView projects
asoc\_get\_projectGet a specific projectView projects
asoc\_create\_projectCreate a projectCreate and edit projects

Layers​

ToolPurposeSystem user permissions
asoc\_get\_project\_layer\_treeGet the project layer hierarchyView layers
asoc\_list\_layersGet a list of layersView layers
asoc\_get\_layerGet layer information by IDView layers
asoc\_create\_layerCreate a layerCreate and edit layers

Vulnerabilities​

ToolPurposeSystem user permissions
asoc\_list\_issuesGet a list of vulnerabilitiesView security issues
asoc\_get\_issueGet vulnerability information by IDView security issues
asoc\_update\_issue\_statusChange a vulnerability statusUpdate security issues
asoc\_get\_issue\_statusesGet vulnerability statuses—
asoc\_group\_update\_statusChange vulnerability statuses in bulkUpdate security issues
asoc\_group\_update\_severityChange vulnerability severity levels in bulkUpdate security issues
asoc\_assign\_issueAssign a person responsibleAssign a person responsible
asoc\_get\_issue\_characteristicsGet vulnerability severity levels—
asoc\_get\_commentsGet commentsView comments
asoc\_add\_commentAdd a commentComment
asoc\_delete\_commentDelete commentsDelete comments
asoc\_get\_mentionsGet mentions of the current user—
asoc\_mark\_mentions\_readMark mentions as read—
asoc\_mark\_comments\_readMark comments as readView comments

Scans​

ToolPurposeSystem user permissions
asoc\_list\_scansGet a list of scansView security checks
asoc\_get\_scanGet scan informationView security checks
asoc\_stop\_scanStop a scanManage security checks
asoc\_list\_scan\_filtersGet scan filtersView security checks
asoc\_compare\_scansCompare two scansView security checks

Security checks​

ToolPurposeSystem user permissions
asoc\_create\_checkCreate a security checkManage security checks
asoc\_get\_checkGet security check informationView security checks
asoc\_run\_checkRun a security checkRun security checks

Statistics​

ToolPurposeSystem user permissions
asoc\_stats\_openGet data about open vulnerabilitiesView security issues
asoc\_stats\_allGet general statisticsView security issues
asoc\_stats\_severityGet statistics by severityView security issues
asoc\_stats\_toolGet statistics by toolView security issues
asoc\_stats\_projectGet statistics by projectView security issues
asoc\_stats\_vulnerabilityGet statistics by CWE/CVEView security issues

Quality gates​

ToolPurposeSystem user permissions
asoc\_list\_gatesGet a list of quality gatesView quality gate templates
asoc\_get\_gateGet quality gate dataView quality gate templates
asoc\_get\_gate\_status\_for\_layerGet the quality gate status for a layerView quality gate templates
asoc\_get\_gate\_status\_for\_checkGet the quality gate status for a security checkView quality gate templates
asoc\_create\_gateCreate a quality gateManage quality gate templates
asoc\_attach\_gate\_to\_checkAttach a quality gate to a security checkManage quality gate templates
asoc\_create\_conditionCreate a quality gate conditionManage quality gate templates

Users​

ToolPurposeSystem user permissions
asoc\_list\_usersGet a list of users—
asoc\_get\_userGet user data by ID—
asoc\_get\_current\_userGet data about the current user—
asoc\_list\_user\_api\_tokensGet a list of user API tokens—
asoc\_delete\_api\_tokenDelete an API token—

Task trackers​

ToolPurposeSystem user permissions
asoc\_list\_trackersGet a list of configured trackersView trackers
asoc\_get\_trackerGet tracker informationView trackers
asoc\_sync\_tracker\_taskSync with a tracker taskCreate tasks for trackers
asoc\_unlink\_tracker\_taskUnlink a tracker taskCreate tasks for trackers

SBOMs and dependencies​

ToolPurposeSystem user permissions
asoc\_list\_sbomsGet a list of SBOM filesView dependencies
asoc\_list\_dependenciesGet a list of dependenciesView dependencies
asoc\_get\_dependencyGet dependency dataView dependencies

FP analysis​

ToolPurposeSystem user permissions
asoc\_fp\_analyzeRun FP analysisWork with FP analysis
asoc\_fp\_get\_analysisGet the FP analysis resultWork with FP analysis

Other tools​

ToolPurposeSystem user permissions
asoc\_list\_reportsGet a list of reportsView reports
asoc\_list\_severitiesGet data about severity levels—
asoc\_list\_toolsGet a list of toolsView tools
asoc\_create\_toolCreate a toolCreate and edit tools
asoc\_update\_toolUpdate a toolCreate and edit tools
asoc\_list\_sourcesGet a list of sourcesView sources
asoc\_create\_sourceCreate a sourceCreate and edit sources
asoc\_update\_sourceUpdate a sourceCreate and edit sources
asoc\_visibility\_filterCheck access to entities—