Coding agent guideAvailable now36 tools

Sythe Labs MCP server

Connect a compatible coding agent to your Sythe Labs account, then inspect controls, review inbox work and notifications, manage evidence, upload documents, and author policy drafts, and complete evidence and control approvals with your existing access.

Connect your coding agent

The fastest option is to copy this prompt into your coding agent. It includes the server URL and the first call needed to confirm the connection.

Prompt for your coding agent

Connect to the Sythe Labs MCP server at https://api.sythelabs.com/api/mcp Use OAuth sign-in when prompted. Do not add an API key or authorization header. After I sign in, call grc_list_organizations and show me the organizations I can access.

Add the server manually

Use a client that supports remote Streamable HTTP MCP servers and OAuth discovery.

MCP server URL

https://api.sythelabs.com/api/mcp

1
Add a standard remote MCP server named Sythe Labs to your coding agent.
2
Paste the server URL below. Leave API key, bearer token, and custom header fields empty.
3
Start the connection, then sign in to Sythe Labs in the browser window that opens and approve access.
4
Return to your coding agent. A successful grc_list_organizations call confirms the connection.

Sign in with Sythe Labs

Starting the connection opens Sythe Labs in your browser. Sign in with your normal account, review the access request, and approve it. Then return to the coding agent. There is no API key to create or paste.

User identity

The OAuth identity is your real Sythe Labs user. The server does not create an agent user or use an API-key substitute.

OAuth flow

The client uses the authorization-code flow with PKCE. Refresh tokens keep an approved connection usable without sharing your password.

Scopes and resource

Consent requests mcp:access for the MCP endpoint and offline_access for refresh tokens. Tokens are bound to the MCP resource.

Live validation

Every request rechecks the user session and OAuth client. Signing out, revoking the session, disabling the client, or banning the user removes access.

Access controls

Agent actions use the same permissions as the signed-in user.

Organization scope

One OAuth grant covers every organization you can currently access. Every scoped tool still requires an explicit organizationId. The server never infers one from an earlier call or your active browser organization.

Role checks

Members use their current organization permissions. Operators can also act in organizations covered by an active assignment. Global admins retain their normal cross-organization access. The MCP allowlist still limits every role to the 36 tools documented here.

Per-call checks

The server reloads authorization for the requested organization and operation on every call. Membership removal, assignment expiry, or a role change takes effect without reconnecting the client.

Tool reference

All 36 available tools. Inputs are strict. Unknown fields, malformed IDs, and missing required values are rejected. List tools accept their documented filters and pagination fields. For ownership updates, discover member IDs with grc_list_organization_members; active assigned operators remain eligible where the resource allows them. Every update call requires at least one mutable field. On a multi-field update, omitting ownerId leaves ownership unchanged, while null clears it. grc_update_control currently supports only ownerId, so it must be supplied. grc_update_evidence and grc_update_risk both support owner assignment and clearing.

Discovery and inbox

Discover organizations and GRC records, inspect inbox work, and apply authorized request transitions.

Sample prompt: "Show me the Sythe Labs organizations I can access."

grc_list_organizations

List up to 100 organizations available to the signed-in user and return the IDs required by other tools.

No parameters.

Sample prompt: "What is waiting for me in the Acme organization inbox?"

grc_list_my_inbox

Read the signed-in user's inbox for one organization, including work waiting for the user and their open submissions.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`view`	string	No	`awaiting_me`	Use awaiting_me for work that needs action or all for the full inbox view.
`cursor`	string	No	-	Opaque cursor returned by a previous inbox response.
`limit`	number	No	`50`	Maximum number of inbox items to return, from 1 to 100.

Sample prompt: "Summarize my unread notifications for Acme."

grc_list_my_notifications

Read the signed-in operator or system administrator's notifications for one organization.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`filter`	string	No	`all`	Filter to all, inbox, or platform notifications.
`limit`	number	No	`25`	Maximum number of notifications to return, from 1 to 100.

Sample prompt: "Approve this policy review request if my account is authorized."

grc_transition_request

Claim, resolve, withdraw, or reassign an inbox request through the existing permission and workflow checks.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`requestId`	string	Yes	-	Request UUID returned by a submit tool or grc_list_my_inbox.
`transition`	object	Yes	-	Transition object. Use action resolve with resolution approved, rejected, or changes_requested to review a policy request.

Sample prompt: "Find the member ID for Jordan Lee in Acme."

grc_list_organization_members

List organization members and user IDs for selecting owners and approvers.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`search`	string	No	-	Optional member name or email search, up to 255 characters.
`page`	number	No	`1`	One-based result page.
`pageSize`	number	No	`50`	Results per page, from 1 to 200.

Sample prompt: "List the frameworks currently activated for Acme."

grc_list_frameworks

List frameworks activated for an organization and return framework IDs that filter controls directly.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.

Sample prompt: "Show me Acme's in-scope controls that are not ready."

grc_list_controls

List controls for an organization. Each result includes the SCF control ID used by other tools.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`search`	string	No	-	Optional control name, number, or text search.
`status`	string	No	-	Filter to in_scope or out_of_scope controls.
`frameworkId`	string	No	-	Framework UUID to filter by.
`sectionId`	string	No	-	Framework section UUID. Requires frameworkId.
`readiness`	string	No	-	Filter to ready or not_ready controls.
`approvalStatus`	string	No	-	Filter by approval state.
`hasApprover`	string	No	-	Use true or false to filter by assigned approver.
`hasEvidence`	string	No	-	Use true or false to filter by linked evidence.
`sortBy`	string	No	`scfNumber`	Column used to sort the controls.
`sortDir`	string	No	`asc`	Sort direction: asc or desc.
`page`	number	No	`1`	One-based result page.
`pageSize`	number	No	`50`	Results per page, from 1 to 200.

Sample prompt: "Give me the current status and evidence for control AC-1 in Acme."

grc_get_control

Get one control and its current compliance detail.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`controlId`	string	Yes	-	SCF control UUID returned by grc_list_controls.

Sample prompt: "List Acme's evidence that needs renewal."

grc_list_evidence

List evidence for an organization, optionally narrowed to one SCF control.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`search`	string	No	-	Optional evidence name or text search.
`status`	string	No	-	Filter by evidence status.
`sourceType`	string	No	-	Filter by file, url, ticket, test, code, config, pentest, survey, or vulnerability_scan source.
`ownerId`	string	No	-	Filter by owner user ID.
`controlId`	string	No	-	SCF control UUID returned by grc_list_controls.
`sortBy`	string	No	`name`	Column used to sort the evidence list.
`sortDir`	string	No	`asc`	Sort direction: asc or desc.
`page`	number	No	`1`	One-based result page.
`pageSize`	number	No	`50`	Results per page, from 1 to 200.

Sample prompt: "Show me the artifacts and linked controls for the latest access review evidence."

grc_get_evidence

Get one evidence record, its artifacts, and its related details.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`evidenceId`	string	Yes	-	Evidence record ID returned by an evidence list, get, or create call.

Sample prompt: "What are the next five compliance tasks Acme should work on?"

grc_get_compliance_next_steps

Return bounded metadata for an agent to select the next five compliance actions.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.

Sample prompt: "Show me Acme's draft policies."

grc_list_policies

List policy summaries and lifecycle states. Use this before creating a policy to avoid duplicates.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`search`	string	No	-	Optional policy name or description search.
`status`	string	No	-	Filter by draft, needs_approval, approved, published, or archived status.
`ownerId`	string	No	-	Filter by owner user ID.
`renewalBefore`	string	No	-	Return policies renewing before this ISO date and time.
`tab`	string	No	-	Filter to the active or archived policy tab.
`sortBy`	string	No	`name`	Column used to sort the policy list.
`sortDir`	string	No	`asc`	Sort direction: asc or desc.
`page`	number	No	`1`	One-based result page.
`pageSize`	number	No	`50`	Results per page, from 1 to 200.

Sample prompt: "Get the current content and version details for Acme's access control policy."

grc_get_policy

Get the current policy HTML, lifecycle status, and version metadata before updating it or creating a new draft version.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.

Organization details

Populate organization profile fields from verified public sources and user-provided information.

Sample prompt: "Update Acme's public company description and security contact using verified information."

grc_update_organization_details

Update one or more organization details. Omitted fields stay unchanged and null clears a field.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`region`	string	No	-	Cosmetic region identifier, such as us-east-1 or eu-west-1.
`renewalLeadDays`	number	No	-	Days before renewal when an inbox reminder should appear, from 1 to 365.
`emailDomain`	string \| null	No	-	Primary company email domain, or null to clear it.
`fullLegalName`	string \| null	No	-	Full legal company name, or null to clear it.
`acronym`	string \| null	No	-	Company acronym, or null to clear it.
`revenueFundingYear`	string \| null	No	-	Four-digit revenue or funding year, or null to clear it.
`phoneNumber`	string \| null	No	-	Company phone number, or null to clear it.
`companyDescription`	string \| null	No	-	Plain-language company description, or null to clear it.
`locationStreet`	string \| null	No	-	Street address, or null to clear it.
`locationCity`	string \| null	No	-	City, or null to clear it.
`locationState`	string \| null	No	-	State or region, or null to clear it.
`locationZip`	string \| null	No	-	Postal code, or null to clear it.
`locationCountry`	string \| null	No	-	Country, or null to clear it.
`privacyPolicyUrl`	string \| null	No	-	Public privacy policy URL, or null to clear it.
`termsOfUseUrl`	string \| null	No	-	Public terms of use URL, or null to clear it.
`subprocessorUrl`	string \| null	No	-	Public subprocessor list URL, or null to clear it.
`securityComplianceEmail`	string \| null	No	-	Security and compliance contact email, or null to clear it.
`securityComplianceEmailEnabled`	boolean	No	-	Whether the security and compliance email is enabled.
`productName`	string \| null	No	-	Primary product name, or null to clear it.
`productUrl`	string \| null	No	-	Primary product URL, or null to clear it.
`productDescription`	string \| null	No	-	Product description, or null to clear it.
`productPurpose`	string \| null	No	-	Product purpose, or null to clear it.
`sla`	string \| null	No	-	Service-level agreement summary, or null to clear it.
`msa`	string \| null	No	-	Master service agreement summary, or null to clear it.

Control writes

Update an individual control owner, stage a control for review, and create its canonical control_review request. Discover member IDs with grc_list_organization_members; active assigned operators also remain eligible where the resource allows them. Every update call requires at least one mutable field. On multi-field owner-bearing updates, omitting ownerId leaves the owner unchanged and null clears it. grc_update_control currently supports only ownerId, so it must be supplied; null clears the owner. grc_update_evidence and grc_update_risk both support owner assignment and clearing.

Sample prompt: "Assign Jordan Lee as the owner of Acme control AC-1."

grc_update_control

Update the canonical individual owner of an existing active control. ownerId is required because it is currently the only mutable field; null clears the owner.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`controlId`	string	Yes	-	SCF control UUID returned by grc_list_controls.
`ownerId`	string \| null	Yes	-	Organization member or active assigned operator user ID, or null to clear the owner.

Sample prompt: "Prepare Acme control AC-1 for review by its assigned operator."

grc_prepare_control_for_review

Assign an eligible approver and move a fresh control into prepare_for_approvers without bypassing an open review.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`controlId`	string	Yes	-	SCF control UUID returned by grc_list_controls.
`approverId`	string	Yes	-	Organization member or active assigned operator user ID.

Sample prompt: "Submit Acme control AC-1 for review and show me the request ID."

grc_submit_control_for_review

Submit a prepared control through the canonical workflow and return its assigned control_review request.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`controlId`	string	Yes	-	SCF control UUID returned by grc_list_controls.

Evidence writes

Build an evidence record, connect its artifacts and controls, and request human review.

Sample prompt: "Create an evidence record for our Q3 access review."

grc_create_evidence

Create a metadata-only evidence record in an organization.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`name`	string	Yes	-	Evidence name, from 1 to 500 characters.
`description`	string	No	-	Optional evidence description, up to 5,000 characters.
`renewalDate`	string	No	-	Optional renewal date and time in ISO format.
`ownerId`	string	No	-	Optional owner user ID returned by grc_list_organization_members.
`status`	string	No	`needs_artifact`	Manual evidence status.
`evidenceRequestId`	string	No	-	Optional evidence request UUID this record fulfills.

Sample prompt: "Set the owner and renewal date for the Q3 access review evidence."

grc_update_evidence

Update at least one metadata field on an existing evidence record, including assigning or clearing its owner. Omitted fields stay unchanged.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`evidenceId`	string	Yes	-	Evidence record ID returned by an evidence list, get, or create call.
`name`	string	No	-	New evidence name.
`description`	string \| null	No	-	New description, or null to clear it.
`renewalDate`	string \| null	No	-	New ISO renewal date, or null to clear it.
`ownerId`	string \| null	No	-	New owner user ID, or null to clear it.
`status`	string	No	-	New manual evidence status.

Sample prompt: "Attach the uploaded access review document to its evidence record."

grc_add_evidence_artifact

Attach one uploaded document as a file artifact.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`evidenceId`	string	Yes	-	Evidence record ID returned by an evidence list, get, or create call.
`artifactType`	string	Yes	-	Must be file for this tool.
`documentId`	string	Yes	-	Completed document UUID to attach.
`expectedDocumentVersionId`	string	No	-	Expected document version UUID for conflict protection.
`label`	string	No	-	Optional human-readable artifact label.
`inputTarget`	object	No	-	Optional configured evidence-input target.

Sample prompt: "Link the Q3 access review evidence to the relevant access controls."

grc_link_evidence_controls

Link evidence to one or more in-scope SCF controls.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`evidenceId`	string	Yes	-	Evidence record ID returned by an evidence list, get, or create call.
`controlIds`	string[]	Yes	-	One to 500 SCF control UUIDs returned by grc_list_controls.

Sample prompt: "Assign Jordan Lee as the approver for this evidence."

grc_set_evidence_approver

Assign or clear the human approver for an evidence record.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`evidenceId`	string	Yes	-	Evidence record ID returned by an evidence list, get, or create call.
`approverId`	string \| null	Yes	-	Approver user ID, or null to clear the approver.

Sample prompt: "Send the Q3 access review evidence to its approver."

grc_submit_evidence_for_review

Submit evidence to its assigned human approver without approving it.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`evidenceId`	string	Yes	-	Evidence record ID returned by an evidence list, get, or create call.

Policy authoring

Create and edit authored policy drafts and ownership while preserving version and review controls.

Sample prompt: "Create a draft acceptable use policy for Acme from this HTML."

grc_create_policy

Create a brand-new authored draft policy only when no existing policy covers the subject. Check grc_list_policies first. Omit html to receive a transfer URL.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`name`	string	Yes	-	Policy name, from 1 to 500 characters.
`description`	string	Yes	-	Policy description, from 1 to 5,000 characters.
`ownerId`	string	No	-	Optional owner user ID.
`renewalDate`	string	No	-	Optional renewal date and time in ISO format.
`assignmentScope`	string	No	-	Optional assignment scope: all_personnel or not_applicable.
`html`	string	No	-	Optional complete policy HTML, up to 48,000 UTF-8 bytes.

Sample prompt: "Create a new draft version of Acme's approved acceptable use policy with this revised HTML."

grc_create_policy_version

Create a new draft version on an existing non-draft policy without creating a duplicate document. Omit html to clone the current content and receive a transfer URL.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.
`versionId`	string	Yes	-	Current policy version UUID returned by grc_get_policy.
`expectedContentHash`	string	Yes	-	Current lowercase SHA-256 content hash returned by grc_get_policy.
`html`	string	No	-	Optional complete replacement HTML, up to 48,000 UTF-8 bytes.

Sample prompt: "Replace the current draft of Acme's acceptable use policy with this revised HTML."

grc_update_policy

Update policy ownership, draft content, or both. Omitted fields stay unchanged and ownerId null clears the owner. versionId, expectedContentHash, and html are required together only when content changes.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.
`ownerId`	string \| null	No	-	Organization member or active assigned operator user ID, or null to clear the owner. Omit to leave it unchanged.
`versionId`	string	No	-	Current policy version UUID returned by grc_get_policy. Required with expectedContentHash and html when content changes.
`expectedContentHash`	string	No	-	Current lowercase SHA-256 content hash returned by grc_get_policy. Required with versionId and html when content changes.
`html`	string	No	-	Complete replacement HTML, up to 48,000 UTF-8 bytes. Required with versionId and expectedContentHash when content changes.

Sample prompt: "Delete the duplicate draft policy I just created."

grc_delete_policy

Delete an unlinked draft policy only when it has never been published as an official version. All other policies require the UI workflow.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.

Sample prompt: "Submit Acme's acceptable use policy for review and return the review request ID."

grc_submit_policy_for_review

Submit a draft policy to the default or selected platform reviewer and return its request ID.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.
`assigneeId`	string \| null	No	-	Optional internal reviewer user ID, or null for server assignment.
`reviewerPersonnelIds`	string[]	No	-	Optional external personnel reviewer UUIDs. Cannot be combined with assigneeId.

Sample prompt: "Send policy review links to these personnel reviewers."

grc_send_policy_review_links

Send one-time review links to personnel who must all approve the current policy version.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.
`reviewerPersonnelIds`	string[]	Yes	-	One or more unique active personnel reviewer UUIDs.

Sample prompt: "Record my operator approval for this policy."

grc_record_policy_operator_approval

Approve the current draft immediately as the signed-in authorized platform reviewer.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.
`resolutionNote`	string \| null	No	-	Optional decision note retained with the approval.

Sample prompt: "Approve this policy using the approved Evidence record."

grc_record_policy_evidence_approval

Approve the current draft using Evidence already approved through the Evidence review pipeline.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.
`evidenceId`	string	Yes	-	Evidence record ID returned by an evidence list, get, or create call.

Sample prompt: "Record that this policy was already approved in Drata."

grc_record_policy_prior_grc_approval

Approve the current draft and retain the named prior GRC platform as the source.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`policyId`	string	Yes	-	Policy ID returned by grc_list_policies or grc_create_policy.
`platformName`	string	Yes	-	Name of the prior GRC platform that approved the policy.

Document uploads

Move document bytes through a signed upload without sending them through MCP context.

Sample prompt: "Prepare this local access-review.pdf file for upload to Acme as Audit evidence."

grc_prepare_document_upload

Reserve a document upload. Choosing Policy also creates draft policy metadata for human review.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`name`	string	Yes	-	Document display name.
`category`	string	Yes	-	Canonical document category, such as Policy, Audit, or Security.
`filename`	string	Yes	-	Local filename without path separators.
`contentType`	string	Yes	-	Document MIME type.
`size`	number	Yes	-	Exact file size in bytes.
`sha256`	string	Yes	-	Lowercase SHA-256 hash of the exact file bytes.
`accessScope`	string	No	`organization`	Visibility scope: organization or org_admin.

Sample prompt: "Create a signed upload URL for the document upload I just prepared."

grc_presign_document_upload

Create a signed PUT handoff for a prepared upload and return the exact required headers.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`uploadId`	string	Yes	-	Prepared upload UUID returned by grc_prepare_document_upload.

Sample prompt: "Complete the document upload after the file transfer finishes."

grc_complete_document_upload

Validate and commit a transferred document using the latest upload attempt.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`uploadId`	string	Yes	-	Prepared upload UUID.
`uploadAttemptId`	string	Yes	-	Latest upload attempt UUID returned by the presign call.

Sample prompt: "Categorize these uploaded documents as Audit."

grc_set_document_category

Set one canonical category on existing documents. Choosing Policy creates draft policy metadata.

Parameter	Type	Required	Default	Description
`organizationId`	string	Yes	-	Organization ID returned by grc_list_organizations.
`documentIds`	string[]	Yes	-	One or more existing document UUIDs.
`category`	string	Yes	-	Canonical category to apply to every selected document.

Evidence workflow

Upload evidence, link it to controls, and send it to a human reviewer.

1
List organizations and select an organizationId.
2
List controls and organization members to resolve controlId, ownerId, and approverId values.
3
Create a metadata-only evidence record, then use grc_update_evidence to assign or clear its owner when needed.
4
Prepare the document upload with file metadata and the file's SHA-256 hash.
5
Presign the upload, then immediately PUT the exact file bytes to uploadUrl with every requiredHeaders entry.
6
Complete the upload using uploadId and the latest uploadAttemptId.
7
Attach the completed document, link the required controls, and set the human approver.
8
Submit the evidence for review and retain the returned evidence, document, and review-request IDs.
9
If the signed-in user is authorized to review it, resolve the evidence_review with grc_transition_request.

Document bytes use a direct upload

MCP tool calls coordinate the upload but do not carry the file. The coding agent must be able to read the local file and send a raw HTTPS PUT using the exact signed headers. A failed or expired PUT requires a new presign call and its new uploadAttemptId.

Control workflow

Discover activated frameworks, assign a durable individual owner, and move an existing control through the canonical review request workflow.

1
List activated frameworks with grc_list_frameworks, then pass a returned frameworkId to grc_list_controls.
2
List organization members and use grc_update_control to assign or explicitly clear the control's individual owner.
3
Attach satisfied evidence to the selected control before submission.
4
Call grc_prepare_control_for_review with an eligible approver user ID.
5
Call grc_submit_control_for_review and retain the returned control_review request ID.
6
If the signed-in user is authorized to review it, resolve the control_review with grc_transition_request.
7
Call grc_get_control and verify the approval status, owner, evidence counts, and absence of an open review.

Existing GRC records only

MCP cannot activate or deactivate frameworks, create or edit SCF controls, or approve evidence, policies, or controls through subject-specific tools. All supported approvals use grc_transition_request and the product's existing gates.

Policy workflow

Author HTML drafts with conflict protection, submit them for review, and apply authorized request transitions.

1
List policies in the selected organization before creating anything, then get the existing policy you want to edit.
2
For inline content, preserve the exact versionId and contentHash returned by grc_get_policy.
3
For a draft, call grc_update_policy to update ownership, content, or both. Supply the full replacement HTML, versionId, and expectedContentHash together only when content changes.
4
For an approved, published, or otherwise non-draft policy, call grc_create_policy_version to append a new draft version to the same document. Resolve or withdraw any open review request first.
5
For large content, download and upload the complete HTML through the returned transfer URLs.
6
If the version or hash is stale, get the policy again and decide how to apply your changes to the current draft.
7
Choose a review path: submit to a platform reviewer, send personnel review links, or record an authorized operator, Evidence, or prior-GRC approval.
8
For a platform review, retain the returned request ID. If the signed-in user is authorized to review it, call grc_transition_request with a resolve transition and the approved, rejected, or changes_requested resolution.

Troubleshooting

Recover from common connection and workflow errors.

OAuth does not open

Confirm the client supports remote Streamable HTTP MCP and OAuth discovery, then remove any manually configured authorization header.

The server returns unauthorized

Reconnect to create a live Sythe Labs session and grant both requested scopes. A signed-out or revoked session cannot use an old token.

An organization or operation is forbidden

Call grc_list_organizations again and confirm the signed-in user still has the required membership, operator assignment, or role permission.

A policy update reports a conflict

The draft changed after it was read. Call grc_get_policy again and use the current version ID and content hash.

A document PUT fails or expires

Call grc_presign_document_upload again, repeat the PUT with the new required headers, and complete with the new uploadAttemptId.