Coding agent guideAvailable now22 tools

Sythe Labs MCP server

Connect a compatible coding agent to your Sythe Labs account, then inspect controls, manage evidence, upload documents, and author policy drafts with your existing access.

Connect

One remote server URL, no manual secret.

Use a client that supports remote Streamable HTTP MCP servers and OAuth discovery. The endpoint below automatically matches the staging or production environment serving this page.

MCP server URL
https://api.sythelabs.com/api/mcp
  1. 01

    Add a standard remote MCP server named Sythe Labs to your coding agent.

  2. 02

    Use the server URL shown below. Do not add an API key, bearer token, or custom header.

  3. 03

    Start the connection. Your client should discover OAuth and open Sythe Labs in a browser.

  4. 04

    Sign in to Sythe Labs and grant access.

  5. 05

    Ask the agent to call grc_list_organizations. A successful organization list confirms the connection.

Authentication

OAuth uses your existing Sythe Labs identity.

The client discovers the protected resource and authorization server from the MCP URL, opens browser sign-in, and manages access and refresh tokens after consent. Do not paste a bearer token into client configuration.

User identity

The OAuth identity is your real Sythe Labs user. The server does not create an agent user or use an API-key substitute.

OAuth flow

The client uses the authorization-code flow with PKCE. Refresh tokens keep an approved connection usable without sharing your password.

Scopes and resource

Consent requests mcp:access for the MCP endpoint and offline_access for refresh tokens. Tokens are bound to the MCP resource.

Live validation

Every request rechecks the user session and OAuth client. Signing out, revoking the session, disabling the client, or banning the user removes access.

Access controls

Agent actions have the same permissions as the signed-in user.

Organization scope

One OAuth grant covers every organization you can currently access. Every scoped tool still requires an explicit organizationId. The server never infers one from an earlier call or your active browser organization.

Role checks

Members use their current organization permissions. Operators can also act in organizations covered by an active assignment. Global admins retain their normal cross-organization access. The MCP allowlist still limits every role to the 22 tools documented here.

Per-call checks

The server reloads authorization for the requested organization and operation on every call. Membership removal, assignment expiry, or a role change takes effect without reconnecting the client.

Tool reference

All 22 available tools.

Tool inputs are strict. Unknown fields, malformed IDs, and missing required values are rejected. List tools accept their documented filters and pagination fields.

Discovery and reads

Discover the organizations, people, controls, evidence, and policies you can access.

grc_list_organizationsRead only

Lists up to 100 organizations available to the signed-in user.

InputsNone
grc_list_organization_membersRead only

Lists members and user IDs for selecting owners and approvers.

InputsorganizationId, optional search and pagination
grc_list_controlsRead only

Lists controls and the SCF controlId values used by other tools.

InputsorganizationId, optional filters, sorting, and pagination
grc_get_controlRead only

Returns one control and its current compliance detail.

InputsorganizationId, controlId
grc_list_evidenceRead only

Lists evidence, optionally narrowed to a specific SCF control.

InputsorganizationId, optional controlId, filters, sorting, and pagination
grc_get_evidenceRead only

Returns one evidence record, its artifacts, and related details.

InputsorganizationId, evidenceId
grc_get_compliance_next_stepsRead only

Returns bounded metadata context for the agent to select the next five compliance actions.

InputsorganizationId
grc_list_policiesRead only

Lists policy summaries and their current lifecycle state.

InputsorganizationId, optional filters, sorting, and pagination
grc_get_policyRead only

Returns current policy HTML inline or through short-lived transfer URLs.

InputsorganizationId, policyId

Organization details

Populate organization profile fields from verified public sources and user-provided information.

grc_update_organization_detailsChanges

Updates organization details. Ask the user for non-public values and only clear fields when they explicitly request it.

InputsorganizationId, one or more organization profile fields

Evidence writes

Build an evidence record, connect its artifacts and controls, and request human review.

grc_create_evidenceCreates

Creates a metadata-only evidence record.

InputsorganizationId, name, optional metadata
grc_update_evidenceChanges

Updates name, description, renewal date, owner, or manual status.

InputsorganizationId, evidenceId, one or more metadata fields
grc_add_evidence_artifactCreates

Attaches one completed document as a file artifact.

InputsorganizationId, evidenceId, artifactType=file, documentId
grc_link_evidence_controlsCreates

Links evidence to in-scope SCF controls.

InputsorganizationId, evidenceId, one or more controlIds
grc_set_evidence_approverChanges

Assigns or clears the human approver.

InputsorganizationId, evidenceId, approverId or null
grc_submit_evidence_for_reviewChanges

Creates a review request for the assigned approver without approving evidence.

InputsorganizationId, evidenceId

Policy authoring

Create and edit authored policy drafts while preserving version and review controls.

grc_create_policyCreates

Creates an authored HTML policy in draft state.

InputsorganizationId, name, description, optional owner, renewal, scope, and HTML
grc_update_policyChanges

Replaces the current draft HTML when its version and hash still match.

InputsorganizationId, policyId, versionId, expectedContentHash, full HTML
grc_delete_policyDeletes

Deletes an unlinked duplicate or unwanted policy when deletion is permitted.

InputsorganizationId, policyId

Document uploads

Move document bytes through a signed upload without sending them through MCP context.

grc_prepare_document_uploadCreates

Reserves upload state and returns upload and attempt IDs.

InputsorganizationId, metadata, category, size, SHA-256, optional accessScope
grc_presign_document_uploadCreates

Returns a signed PUT URL and the exact headers required for transfer.

InputsorganizationId, uploadId
grc_complete_document_uploadChanges

Verifies the transferred object and commits the document version.

InputsorganizationId, uploadId, latest uploadAttemptId
grc_set_document_categoryChanges

Sets one canonical category on existing documents.

InputsorganizationId, one or more documentIds, category
Evidence workflow

Upload evidence and send it to a human reviewer.

  1. 01

    List organizations and select an organizationId.

  2. 02

    List controls and organization members to resolve controlId, ownerId, and approverId values.

  3. 03

    Create a metadata-only evidence record.

  4. 04

    Prepare the document upload with file metadata and the file's SHA-256 hash.

  5. 05

    Presign the upload, then immediately PUT the exact file bytes to uploadUrl with every requiredHeaders entry.

  6. 06

    Complete the upload using uploadId and the latest uploadAttemptId.

  7. 07

    Attach the completed document, link the required controls, and set the human approver.

  8. 08

    Submit the evidence for review and retain the returned evidence, document, and review-request IDs.

Policy workflow

Author HTML drafts with conflict protection.

  1. 01

    List policies in the selected organization, then get the policy you want to edit.

  2. 02

    For inline content, preserve the exact versionId and contentHash returned by grc_get_policy.

  3. 03

    Call grc_update_policy with the full replacement HTML, versionId, and expectedContentHash.

  4. 04

    For large content, download and upload the complete HTML through the returned transfer URLs.

  5. 05

    If the version or hash is stale, get the policy again and decide how to apply your changes to the current draft.

  6. 06

    Leave review, approval, and publication to the existing human workflow.

Troubleshooting

Recover from common connection and workflow errors.

OAuth does not open

Confirm the client supports remote Streamable HTTP MCP and OAuth discovery, then remove any manually configured authorization header.

The server returns unauthorized

Reconnect to create a live Sythe Labs session and grant both requested scopes. A signed-out or revoked session cannot use an old token.

An organization or operation is forbidden

Call grc_list_organizations again and confirm the signed-in user still has the required membership, operator assignment, or role permission.

A policy update reports a conflict

The draft changed after it was read. Call grc_get_policy again and use the current version ID and content hash.

A document PUT fails or expires

Call grc_presign_document_upload again, repeat the PUT with the new required headers, and complete with the new uploadAttemptId.