Integrating TRON.ASOC with MCP clients

The system supports the MCP (Model Context Protocol)—a standard for interaction between AI agents and external tools and data. TRON.ASOC acts as an MCP server and gives AI agents access to vulnerability, scan, project, and other system entity management functions.

Implementation characteristics:

• Protocol: JSON-RPC 2.0;
• Data transfer: Streamable HTTP (primary), SSE (legacy).

Requirements

Before you start, make sure that:

• TRON.ASOC version 1.7 is installed on your workstation;
• a compatible MCP client, such as Claude Code or Cursor, is installed on your workstation;
• an API token with the required access permissions has been created for your TRON.ASOC account. For more information about creating an API token, see Create an API token.

Authentication

The TRON.ASOC MCP server uses the X-API-Token header, which contains a valid user API token.

The user's roles and policies determine access to the tools. The request runs on behalf of this user.

Server configuration

Configure the MCP server in the config.yml file:

mcp:
  enabled: true
  tools: \[]  # пустой массив = все инструменты включены

To limit the available tools, specify their names in the tools array:

mcp:
  enabled: true
  tools:
    - asoc_list_projects
    - asoc_get_project
    - asoc_list_issues

Connecting an MCP client

This section explains how to connect the Claude Code MCP client.

To connect the MCP client, follow these steps:

1. Create or edit the \~/.claude/mcp.json file:

{
  "mcpServers": {
    "asoc": {
      "type": "http",
      "url": "https://<asoc-host>/mcp",
      "headers": {
        "X-API-Token": "<ваш-api-токен>"
      }
    }
  }
}

2. Verify the connection with curl:

TOKEN="<ваш-api-токен>"
URL="https://<asoc-host>/mcp"

# 1. Инициализация сессии
SESSION=$(curl -s -D - -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' \\
  | grep -i "Mcp-Session-Id" | awk '{print $2}' | tr -d '\\r')

# 2. Подтверждение готовности клиента
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}'

# 3. Получение списка инструментов
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

# 4. Вызов инструмента
curl -s -X POST $URL \\
  -H "Content-Type: application/json" \\
  -H "X-API-Token: $TOKEN" \\
  -H "Mcp-Session-Id: $SESSION" \\
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"asoc_list_projects","arguments":{}}}'

Available MCP tools

The tables below list MCP tools that you can use to perform actions on system entities, for example, create a project or layer, change a vulnerability status, or start a scan.

Projects

Tool	Purpose	User system permissions
asoc_list_projects	Get a list of projects	View projects
asoc_get_project	Get a specific project	View projects
asoc_create_project	Create a project	Create and edit projects

Layers

Tool	Purpose	User system permissions
asoc_get_project_layer_tree	Get the project layer hierarchy	View layers
asoc_list_layers	Get a list of layers	View layers
asoc_get_layer	Get layer information by ID	View layers
asoc_create_layer	Create a layer	Create and edit layers

Vulnerabilities

Tool	Purpose	User system permissions
asoc_list_issues	Get a list of vulnerabilities	View security issues
asoc_get_issue	Get vulnerability information by ID	View security issues
asoc_update_issue_status	Change a vulnerability status	Update security issues
asoc_get_issue_statuses	Get vulnerability statuses	—
asoc_group_update_status	Change the status of multiple vulnerabilities	Update security issues
asoc_group_update_severity	Change the severity of multiple vulnerabilities	Update security issues
asoc_assign_issue	Assign an owner	Assign an owner
asoc_get_issue_characteristics	Get vulnerability severity levels	—
asoc_get_comments	Get comments	View comments
asoc_add_comment	Add a comment	Comment
asoc_delete_comment	Delete a comment	Delete comments
asoc_get_mentions	Get mentions of the current user	—
asoc_mark_mentions_read	Mark mentions as read	—
asoc_mark_comments_read	Mark comments as read	View comments

Scans

Tool	Purpose	User system permissions
asoc_list_scans	Get a list of scans	View security checks
asoc_get_scan	Get scan information	View security checks
asoc_stop_scan	Stop a scan	Manage security checks
asoc_list_scan_filters	Get scan filters	View security checks
asoc_compare_scans	Compare two scans	View security checks

Security checks

Tool	Purpose	User system permissions
asoc_create_check	Create a security check	Manage security checks
asoc_get_check	Get security check information	View security checks
asoc_run_check	Run a security check	Run security checks

Statistics

Tool	Purpose	User system permissions
asoc_stats_open	Get data about open vulnerabilities	View security issues
asoc_stats_all	Get overall statistics	View security issues
asoc_stats_severity	Get severity statistics	View security issues
asoc_stats_tool	Get tool statistics	View security issues
asoc_stats_project	Get project statistics	View security issues
asoc_stats_vulnerability	Get CWE/CVE statistics	View security issues

Quality gates

Tool	Purpose	User system permissions
asoc_list_gates	Get a list of quality gates	View quality gate templates
asoc_get_gate	Get quality gate data	View quality gate templates
asoc_get_gate_status_for_layer	Get the quality gate status for a layer	View quality gate templates
asoc_get_gate_status_for_check	Get the quality gate status for a security check	View quality gate templates
asoc_create_gate	Create a quality gate	Manage quality gate templates
asoc_attach_gate_to_check	Attach a quality gate to a security check	Manage quality gate templates
asoc_create_condition	Create a quality gate condition	Manage quality gate templates

Users

Tool	Purpose	User system permissions
asoc_list_users	Get a list of users	—
asoc_get_user	Get user data by ID	—
asoc_get_current_user	Get data about the current user	—
asoc_list_user_api_tokens	Get a list of the user's API tokens	—
asoc_delete_api_token	Delete an API token	—

Issue trackers

Tool	Purpose	User system permissions
asoc_list_trackers	Get a list of configured trackers	View trackers
asoc_get_tracker	Get tracker information	View trackers
asoc_sync_tracker_task	Sync with a tracker task	Create tracker tasks
asoc_unlink_tracker_task	Unlink a tracker task	Create tracker tasks

SBOMs and dependencies

Tool	Purpose	User system permissions
asoc_list_sboms	Get a list of SBOM files	View dependencies
asoc_list_dependencies	Get a list of dependencies	View dependencies
asoc_get_dependency	Get dependency data	View dependencies

FP analysis

Tool	Purpose	User system permissions
asoc_fp_analyze	Run FP analysis	Work with FP analysis
asoc_fp_get_analysis	Get the FP analysis result	Work with FP analysis

Other tools

Tool	Purpose	User system permissions
asoc_list_reports	Get a list of reports	View reports
asoc_list_severities	Get severity level data	—
asoc_list_tools	Get a list of tools	View tools
asoc_create_tool	Create a tool	Create and edit tools
asoc_update_tool	Update a tool	Create and edit tools
asoc_list_sources	Get a list of sources	View sources
asoc_create_source	Create a source	Create and edit sources
asoc_update_source	Update a source	Create and edit sources
asoc_visibility_filter	Check access to entities	—