What is MCP?
MCP (Model Context Protocol) is an open standard that lets AI assistants, like Claude, connect to outside tools and services. It always asks for your explicit permission first.
Think of it as a bridge. Instead of copying data back and forth between Thoropass and your AI assistant, MCP lets the assistant work directly inside your Thoropass workspace, within limits you set.
Why connect it?
Compliance work means a lot of back and forth. You're reviewing audits, tracking evidence requests, managing comments, and keeping statuses current. The Thoropass MCP server lets your AI assistant help with that work right where you're already working, so you don't have to export data and upload it somewhere else.
Once it's connected, you can ask things like:
"What evidence requests are still outstanding on this audit?"
"Summarize the open items across my current audits."
"Add a comment to this evidence request explaining the delay."
"List all evidence requests tied to the access control systems."
What the agent can do
You choose what to grant, and it comes in two groups.
Read-only
List audits and view audit details
List evidence requests, view their details, and see the systems tied to them
Interactive (write)
Add comments, attachments, and status updates to evidence requests
If you want the technical version, these map to OAuth scopes:
mcp:invoke (always required)
audit:read
evidenceRequest:read
evidenceRequest:write
Add or remove the last three depending on what you want your agent to be able to do.
How to connect
There are two ways to connect. Pick whichever fits your setup.
Option A: Auto-discovery (recommended) - Your AI client registers itself the first time it connects. There's nothing to set up in Thoropass ahead of time, you just add the server URL to your config and go. This is the easiest option if you're setting this up for yourself.
Option B: Managed Client ID - An admin creates a named MCP integration in Thoropass first, which generates a Client ID. You then paste that ID into your config. This is the better fit for teams who want a centrally managed integration with a fixed set of permissions.
Setup instructions
Claude Desktop
Open your config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Option A (auto-discovery):
{
"mcpServers": {
"thoropass": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://api.thoropass.com/mcp"]
}
}
}
Option B (with a Client ID):
{
"mcpServers": {
"thoropass": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"--static-oauth-client-metadata",
"{\"clientId\":\"YOUR_CLIENT_ID\",\"scope\":\"mcp:invoke audit:read evidenceRequest:read evidenceRequest:write\"}"
]
}
}
}
Quit Claude Desktop completely and reopen it after saving. Your browser will pop up for sign-in the first time.
Note: mcp-remote is a small helper that connects Claude Desktop to remote MCP servers. It runs through npx, which comes bundled with Node.js. If you don't have Node.js installed, install it first.
Claude CLI
The fastest way:
claude mcp add --transport http thoropass https://api.thoropass.com/mcp
Or add it by hand to your project's .mcp.json:
Option A:
{
"mcpServers": {
"thoropass": {
"type": "http",
"url": "https://api.thoropass.com/mcp"
}
}
}
Option B:
{
"mcpServers": {
"thoropass": {
"type": "http",
"url": "https://api.thoropass.com/mcp",
"clientId": "YOUR_CLIENT_ID"
}
}
}
Any other MCP-compatible client
Point your client at the server URL below and set it up with OAuth 2.0, Authorization Code with PKCE (public client):
|
|
MCP server URL | |
Protected resource metadata | |
Authorization server metadata | |
Authorize endpoint | |
Token endpoint | |
Dynamic registration (Option A) |
Creating an integration in Thoropass (Option B only)
If you're going the Managed Client ID route, an admin needs to set this up first:
Sign in to Thoropass.
Go to Settings → Authentication Settings.
Under MCP Configuration, click Create MCP connection.
Fill in the form:
Name: something recognizable, like "Claude Desktop – Engineering"
Redirect URI: the callback URL your client uses after sign-in (usually a localhost address, check your client's docs)
Tool permissions: pick the capabilities you want to grant
Click Create.
Open the integration and copy the Client ID to share with your team.
The Client ID isn't a secret. It just identifies the integration, and users paste it into their config as shown above.
Signing in (the browser step)
The first time your client connects, it opens a Thoropass page in your browser:
Log in to Thoropass, if you're not already.
Review the authorization screen. It shows which app is connecting and what it's asking for.
Click Authorize.
Your client securely receives access credentials. You never copy or paste a password.
You only need to do this once per client. If your credentials expire or get revoked, you'll be asked to authorize again.
Managing connections
From Settings → Authentication Settings → MCP Configuration, you can:
Edit: update the name, redirect URI, or permissions for an integration
Revoke: cancel current credentials without deleting the integration (the agent will need to re-authorize)
Delete: remove the integration entirely (any connected agent stops working right away)
Troubleshooting
Browser opened but nothing happened, or I wasn't logged in. Log in to Thoropass in that same browser first, then try connecting again.
Agent says it's unauthorized or out of scope. The integration is missing a permission it needs. Edit it (Option B) or re-authorize and turn on the tool group you need.
npx or mcp-remote not found. Install Node.js, which includes npx, then restart your client.
I accidentally revoked or deleted my integration. Recreate it (Option B), or just reconnect using auto-discovery (Option A) and authorize again.
Quick reference
|
|
MCP server URL | |
Auth method | OAuth 2.0, Authorization Code + PKCE (public client) |
Connection modes | Auto-discovery (no ID) or Client ID |
Full scope string | mcp:invoke audit:read evidenceRequest:read evidenceRequest:write |
Manage integrations | Settings → Authentication Settings → MCP Configuration |