Tools & Workflows

Once you’ve connected an MCP client, you don’t call tools directly — you ask the assistant in plain language (“score RSK-128 against our RAMP”, “summarize the open incidents”) and it picks the right tools for the job. This page shows how to see what’s available and walks through the workflows the connection is designed for.

Discovering the available tools

The assistant loads its tools from the server when it connects, and that set grows over time — so the live list is always the source of truth. To see what’s currently available:

• In Claude Code, run /mcp and select the adversarial server to see its tools.
• In any client, just ask — for example “what can you do with the adversarial server?” — and the assistant lists what it has.

At a high level the connection covers your risks, incidents, comments, threat profile, tags, compliance documents, and parent/child record relationships, plus your team roster for assigning work. Reading is available at either access level; creating, editing, commenting, and managing hierarchies require read & write (mcp:full) and a role that permits the action.

When searching for risks or incidents, multi-word queries use AND semantics — each word must appear somewhere in the record (title, description, or comments), so "local administrator rights" finds records that contain all three words even if they’re not adjacent or in the same field.

Example workflows

Ask in plain language and the assistant chains the right tools behind the scenes. You can name people by email or full name in any of these — for example “assign RSK-42 to Ada Lovelace” — without looking up an ID first; if a name is ambiguous, the assistant asks you to confirm.

Score a risk against the RAMP

“Score RSK-128 against our RAMP and update it.”

The assistant reads the risk, pulls your Risk Assessment Management Procedure (RAMP) for the scoring methodology, proposes a likelihood and impact with written rationale, and — with write access — saves them to the risk. Urgency is recalculated automatically from likelihood × impact; you never set it directly. The rationale is stored on the record, giving you the same audit trail as in-app AI scoring.

Triage incidents against the CIRP

“Review the open incidents and propose a severity for each, per our CIRP.”

The assistant lists open incidents, reads your Cyber Incident Response Procedure (CIRP), and proposes a severity with rationale for each — assigning the relevant threat objectives along the way.

Assign threat objectives and tags

“Tag RSK-128 as BU:Enterprise and link it to the relevant threat objectives.”

The assistant checks your threat profile for valid objective names and your existing tags (creating one if nothing matches), then applies them.

Note

Over the MCP connection, assigning threat objectives adds or updates them — it does not remove objectives that are already linked. To remove one from a record, do it in the app. Tags, by contrast, are replaced with the set you specify.

Work with parent/child hierarchies

“Create a child risk under RSK-42 for the web application attack surface and assign it to Ada Lovelace.”

The assistant creates the new risk pre-linked as a child of RSK-42. You can also ask it to list the children of any risk or incident, link an existing record under a parent, or unlink a record from its parent. The same single-level constraint applies as in the app — a child record cannot itself be a parent.

Read a procedure

“Summarize our incident response procedure.”

The assistant fetches the compliance document and answers from its contents — useful for onboarding or for checking what your own policy says before you act.