Connect an AI Agent to Boundera

What the connector is

Boundera speaks the Model Context Protocol, the open standard AI agents use to reach outside tools. Once connected, an agent such as Claude can read your FedRAMP 20x posture in plain language, and, if you allow it, make the same changes you would make in the console: dismiss a gap, set a rule status, register a policy, run monitoring.

The connector address is:

https://boundera.io/mcp

There is nothing to install on your side and no key to copy. The agent registers itself, sends you to Boundera to sign in, and asks for your consent. Everything it can do afterwards is what you approved, for the one tenant you chose.

Who can connect

• Owners and members of your organization. Assessors and external viewers cannot connect an agent, whatever access they hold in the console.
• Your organization owner must have switched the connector on for the tenant. It is off until they do, and they can switch it off again at any time, which stops every agent on its next call.
• One connection is one person and one tenant. To let an agent reach a second tenant, connect again and choose it.

Connect from Claude

On an individual Pro or Max plan, open Customize, then Connectors, choose Add custom connector, paste the connector address, and click Add. Then click Connect and follow the sign-in.

On a Team or Enterprise plan, an organization owner adds it once under Organization settings, then Connectors, Add, Custom, Web. Each member then finds it under Customize, Connectors and clicks Connect.

From Claude Code, in a terminal:

claude mcp add --transport http boundera https://boundera.io/mcp

Connect from Cursor

Open Cursor's settings and go to its MCP section, which in Cursor 3.14 is Customize and then the MCPs tab. Choose New MCP Server, add a custom server, and give it the connector address.

Boundera then appears under Connected with a login button. Click it, sign in, choose the tenant, and approve the permissions. The entry then reports the tools it can see, 48 of them today.

You can also write the server straight into ~/.cursor/mcp.json:

{
  "mcpServers": {
    "boundera": { "url": "https://boundera.io/mcp" }
  }
}

Other agents

Claude and Cursor are the two we have connected ourselves. Any other agent works on the same terms, and there are only two:

• It speaks the protocol over streamable HTTP. There is one endpoint and no older event-stream fallback.
• It signs in with OAuth and registers itself as it goes. There is no client identifier to hand out by hand.

The answer can come back to a web address or to the agent's own scheme on your machine, whichever it uses. If your agent needs a client identifier and secret typed in, it cannot connect yet; tell us which one and we will look at it.

What happens when you connect

Boundera opens its sign-in page. After you sign in, it asks two things: which tenant the agent may reach, and which permissions to grant. The permissions are:

• Read your posture. Indicators, gaps, checks, evidence, rules, monitoring runs and the package.
• Change your posture. Dismiss and reopen gaps, disable checks, re-run an indicator, set rule statuses and fields, save indicator statements, run monitoring now.
• Read your policies. The policy register, your policy documents and your review records.
• Change your policies. Register and tag policies, update register entries, put entries on your Trust Center, record reviews. What is written is evidence, and what reads it is re-graded.
• Stay connected without asking you to sign in again.

You can grant the reads alone. The connection then stays until you end it, or until the agent has not used it for thirty days.

What the agent can do

The agent sees a fixed set of tools, each the same one the console's own assistant uses, answering only for your tenant. Reads cover readiness, every Key Security Indicator with its gaps, checks, implementations and evidence chain, the 2026 rules and the requirements plan, continuous monitoring runs and what changed between them, package validation, the policy register and policy documents, review records, and the vulnerability rules.

Writes are the changes listed under the permissions above. Every write is marked to the agent as one that changes data, and the agent is told to ask you before calling it. Boundera does not pause the call itself: its own checks are the permission you granted, your role, and the record of the call.

• Every call is recorded: who, which tenant, which tool, and how it ended.
• Answers carry only your tenant's data. Links point at pages in Boundera that ask who you are, never at a file directly.
• Recording a rule deviation needs an organization owner's connection, as it does in the console.
• A connection may make sixty calls a minute, and a call that runs longer than fifty seconds is answered with a note to try again more narrowly.

Ending a connection

In Boundera, open Settings, then Connected apps. You see every connection you made, which agent holds it, when it was last used, and a button to end it. Ending it stops the agent on its next call. Organization owners see every connection in the organization and can end any of them, or switch the connector off for a tenant altogether.

Removing the connector inside the agent ends it from that side too. Either is enough.

Security and questions

The connector runs only over HTTPS, uses OAuth 2.1 with proof keys, keeps tokens hashed at rest, and refuses a token minted for any other service. How we secure the platform as a whole is on our security page, and how we handle data in our privacy policy.

To report a security concern about the connector, write to security@boundera.io.