CRA Desk for AI agents (MCP)

CRA Desk runs a Model Context Protocol (MCP) server for Team and Enterprise plans. An agent you connect can read your products, vulnerabilities, cases and documents, and can ask for changes. It cannot make a change on its own: every write waits for a person to approve it in the panel.

Tokens

• A read-only token can look but not change anything. It is the default.
• A read and write token can also file requests to change data. A request does nothing until someone approves it. Changing a token’s kind means creating a new token.
• The component inventory is a separate, opt-in scope. An agent with it can read your dependency list, which then reaches whatever model provider you connected the agent to.
• Tokens expire, after 90 days at most. Revoking one cancels the requests it still had waiting.

How approval works

A person decides each request on its own screen in the panel. The screen shows what approving would do.

• The effect is computed from the current state of your data, not taken from the agent’s description.
• The agent’s own explanation is shown as unverified text, below the effect.
• For recording a filing or a notification, the person confirms they did it themselves, outside CRA Desk.
• The approved change is applied as the person who approved it, and the record keeps a link back to the request.

Tools

Read

Available to every token. Package names and advisory text in results come from third parties and are data, not instructions.

• whoami
• list_products
• get_product
• list_product_versions
• list_vulnerabilities
• vulnerability_summary
• get_feed_health
• list_cases
• get_case
• get_case_draft
• compute_affected_versions
• list_case_advisories
• get_advisory_download_url
• list_notification_records
• list_documents
• get_document_download_url
• list_template_sets
• list_monthly_reports
• get_monthly_report
• classify_product
• get_agent_action
• list_agent_actions
• list_components
• list_sboms
• diff_sboms

Request a change

Read and write tokens only. Each one files a request and changes nothing until it is approved.

• create_product
• update_product
• set_product_classification
• delete_product
• activate_product_version
• decommission_product_version
• set_vulnerability_status
• report_upstream
• open_case
• update_case_notes
• set_case_awareness_anchor
• set_case_remediation
• record_case_submission
• close_case
• publish_case_advisory
• record_advisory_dispatch
• generate_document
• publish_vendor_template

What an agent cannot do

• Nothing is ever filed with ENISA or a CSIRT by an agent or by CRA Desk. A person files, then records it.
• It cannot manage billing, team members, tokens, published content, or delete or export an account.
• It cannot approve its own request, and a leaked token cannot approve anything.

Limits

Each plan has a monthly budget of agent calls and a number of active tokens, and every token is limited to 60 calls a minute.

Where the data goes

What an agent reads is sent to the model provider you chose for it. That is your choice and your data. Leave the inventory scope off unless the agent needs it.

Connecting

Create a token under Agents in the panel. The panel shows the server address and a ready configuration for common clients, with the token filled in once, when you create it.

Known limit: the server takes a bearer token, not OAuth. Connectors that only offer an OAuth sign-in, such as the ones in claude.ai and Claude Desktop, cannot connect yet.