Skip to content

MCP Configuration

The Model Context Protocol (MCP) lets external AI clients — such as Cursor, Claude Desktop, or custom agents — connect to Trust3 and access governance context outside the Trust3 UI. Use MCP when you want inventory, policy, and trust-score answers in the tools your team already uses.

For in-product governance questions, use GIA (Governance Intelligence Agent). MCP is the external, protocol-based path to similar governance data.


Prerequisites

Before configuring an MCP client, ensure you have:

Requirement Description
Trust3 account Access to your Trust3 AI Governance tenant
MCP scoped API key A scoped key with MCP (read) — grants read-only access for MCP clients. Do not reuse collector or other API keys unless they include this scope.
Inventory (recommended) AI asset inventory populated via the AI Assets Collector so MCP queries return meaningful governance context

Generate an MCP scoped API key

MCP clients authenticate with a scoped API key — not the same key you use for the AI Assets Collector. Each key is limited to the permissions you select at creation time.

For MCP configuration, create a key with the MCP (read) scope. That scope allows read-only access to governance context through the MCP server (inventory, policies, trust scores, and similar read operations your role can already see in Trust3).

Who can create keys

Any Trust3 role can generate an MCP (read) scoped key for their own use.

Available scopes

Today, MCP (read) is the only scope used for MCP client configuration. Additional scopes may be added in future releases.

  1. Log in to Trust3 AI.
  2. Go to SettingsAPI Keys.
  3. Click Generate scoped key.
  4. Set:
    • Name — a label you will recognize later (for example cursor-mcp or claude-desktop).
    • Description (optional) — where the key is used or who owns it (for example Cursor on MacBook).
    • Expiry — select 7 days, 30 days, 90 days, 1 year, or Custom.
    • Scope — select MCP (read).
  5. Click Generate, then copy the key immediately. You will not be able to view the full key again.

Generate MCP scoped API key dialog

Use this key as the value for x-trust3ai-key in your MCP configuration below.


MCP client configuration

Add the Trust3 MCP server to your client's MCP configuration file (for example mcp.json or the equivalent for your AI tool).

JSON
{
  "mcpServers": {
    "trust3ai-mcp-server": {
      "transport": "streamable_http",
      "url": "https://api.na.trust3ai.com/mcp",
      "headers": {
        "Accept": "application/json, text/event-stream",
        "x-trust3ai-key": "<api-key>"
      }
    }
  }
}

Replace <api-key> with the key you generated above.

Parameter Description
Client name trust3ai-mcp-server — customize if your client requires a different key
transport streamable_http — HTTP-based MCP transport
url https://api.na.trust3ai.com/mcp — Trust3 MCP server endpoint (NA cloud)
Accept Required for streamable HTTP responses
x-trust3ai-key Your MCP (read) scoped API key from SettingsAPI Keys

Verify the connection

  1. Save your MCP configuration file.
  2. Restart your AI client (or reload MCP servers if the client supports hot reload).
  3. Confirm the Trust3 MCP server appears in the client's MCP server list.
  4. Ask a governance question (for example, "What agents need attention?") and confirm you receive a response grounded in your inventory.

Troubleshooting

Issue What to check
Connection refused Confirm the URL is https://api.na.trust3ai.com/mcp and your network allows outbound HTTPS to api.na.trust3ai.com
Authentication failed Confirm the key has the MCP (read) scope, has not expired, and is sent in the x-trust3ai-key header. Collector or other non-MCP keys will not work for MCP clients.
Empty or generic answers Ensure inventory has been ingested via the AI Assets Collector