Connect Signals Corps with MCP
Model Context Protocol (MCP) connects supported AI tools to authorized Signals Corps data and actions. Browser OAuth signs you in with your Signals Corps account, and the server enforces your current Workspace membership and role on every request.
Supported changes use a preview and explicit confirmation before Signals Corps applies them.
Copy the setup prompt
Paste this prompt into an AI tool that can manage a remote MCP connection. The tool reads the maintained guide for this environment before changing its configuration.
Set up Signals Corps for this AI tool. First read and follow the official setup guide at https://controlplane.signalscorps.com/docs/mcp-setup.md. Connect the MCP server with the documented OAuth flow. If you can run local commands, also check whether this computer meets the documented CLI requirements and whether the Signals Corps CLI is already installed; before installing or changing anything, explain the exact change and wait for my approval. Do not ask me to copy or paste a bearer token. After connecting, list my Workspaces. Do not run a scan until I ask. Never confirm a write action until you have shown me its preview and I explicitly approve it.What MCP can access
Section titled “What MCP can access”MCP exposes bounded Control Plane reads and supported actions. It can list accessible Workspaces, read Supply Chain posture and results, and prepare supported scan or administration changes.
Connecting MCP does not broaden access. The server does not return repository source, credentials, inaccessible resource existence, or complete private files.
Read tools cover security posture, repositories, scans, rules, and plan usage. Supported write workflows can prepare repository protection or monitoring changes, on-demand scans, exact-revision re-runs, and Workspace invitation creation. A prepared action expires after ten minutes and does not change anything until the user confirms its exact preview and digest.
MCP cannot change policy, change an existing member’s role, delete resources, transfer ownership, or modify billing.
Authentication and permissions
Section titled “Authentication and permissions”The MCP client opens browser OAuth. Sign in with the same Signals Corps account used for the Control Plane. Do not copy a bearer token into the client or an AI conversation.
Signals Corps checks live Workspace membership and role on every request. Owners and administrators can manage supported Workspace settings. Developers can read product data and run scans but cannot perform administrative actions.
Verify the connection
Section titled “Verify the connection”Ask the connected tool to list your Workspaces. A successful response verifies the protocol connection, browser authentication, Signals Corps identity link, and current Workspace membership without starting a scan.
Revoke access
Section titled “Revoke access”Remove the Signals Corps server from the MCP client to delete its local connection. Removing a client does not delete Control Plane data.
Troubleshooting
Section titled “Troubleshooting”- If browser authentication does not open, confirm the client supports remote MCP OAuth and use the exact server URL from the machine setup guide.
- If a Workspace is missing, ask a Workspace administrator to review your membership.
- If access changed, reconnect so the client obtains a fresh session. The server still checks membership on every request.
- An “unavailable or inaccessible” response intentionally does not reveal whether another Workspace’s resource exists.