{"name":"Smpl Security MCP","version":"1.0.0","description":"Security findings and compliance status for your organisation.","tools":[{"name":"list_connectors","description":"List all integrations connected to this organisation — GitHub, Vercel, Supabase, Stripe, Salesforce, HubSpot, etc. Returns the connector type, account name, status, and when it was last scanned. Use connector_type values from this response to filter get_findings by a specific integration."},{"name":"get_findings","description":"List open security findings for the organisation. Returns title, severity, affected asset, rule ID, and first-seen date. Filter by severity and/or connector_type to focus on what matters most."},{"name":"get_finding_detail","description":"Get full details and fix instructions for a specific finding. Returns the finding plus a remediation playbook with copy-paste fix steps."},{"name":"get_compliance_status","description":"Get the organisation's compliance readiness score and a breakdown by control category. Supports SOC 2, ISO 27001, and HIPAA frameworks. Optionally include per-control details."},{"name":"update_finding_status","description":"Update the status of a finding. Use 'dismissed' for false positives, 'wont_fix' for accepted risk, 'resolved' when manually fixed, or 'open' to reopen."},{"name":"check_vercel_headers","description":"Diagnostic tool: inspect exactly which security headers are present for a Vercel project. Two modes: (1) Pass vercel_json_content and/or build_output_config_content if you have local filesystem access to the project — the tool parses them directly and returns which security headers are configured vs missing. (2) Omit both to have the tool attempt to fetch via Vercel API — if the file tree is unavailable (common for git-triggered deployments), the response includes a next_step telling you exactly which files to read and which params to pass on the next call. Always prefer mode (1) if you can read the project files."},{"name":"get_guidance_for_diff","description":"Get org-specific security guidance for a file being written or modified. Pass the file path and unified diff — returns open findings relevant to the resources being touched (Supabase tables, auth calls, env vars, Stripe objects, API routes), plus remediation steps. Call this before writing security-sensitive code to surface known issues in your org's posture."},{"name":"list_frameworks","description":"List available compliance frameworks (SOC 2, ISO 27001, HIPAA) with readiness scores for each. Useful to see which frameworks the organisation is tracking and their overall progress."},{"name":"get_control_requirements","description":"Get detailed requirements for a specific compliance control including its test procedure, required evidence types, and which scan rules provide automated coverage."},{"name":"get_compliance_gaps","description":"Identify compliance gaps — controls that are not yet complete. Filter by framework, category, or status to focus on what needs attention. Returns controls grouped by category with evidence gaps highlighted."},{"name":"get_evidence_templates","description":"Get structured templates for a specific type of compliance evidence. Returns required sections, fields, and example content to guide evidence collection."},{"name":"get_remediation_guidance","description":"Get step-by-step remediation guidance for a finding or a compliance control. For findings, returns the playbook and affected controls. For controls, returns what evidence is needed and an effort estimate."},{"name":"upload_evidence","description":"Upload compliance evidence for a control. Supports text content or a URL reference. Creates a compliance_evidence record and returns the evidence ID."},{"name":"link_evidence","description":"Link existing evidence or a scan finding to a compliance control. Creates a cross-reference so the control shows coverage from the linked item."},{"name":"create_attestation","description":"Create an attestation for a compliance control. An attestation is a signed statement confirming a control is operating effectively. Automatically promotes the control status."},{"name":"set_evidence_review_status","description":"Update the review status of a piece of evidence. Move evidence through the review workflow: collected → approved or rejected."},{"name":"schedule_evidence_renewal","description":"Set a renewal due date on a piece of evidence. Use this to track when evidence needs to be refreshed (e.g. annual policy reviews, quarterly access reviews)."}]}