MTC Skopos + AI

Your data, structured for AI agents to reason about.

MTC Skopos is designed from the ground up for the AI era. While traditional GRC tools trap your data behind dashboard-first interfaces, MTC Skopos prepares and structures your SAP authorization data so AI agents can analyze it directly.

Three modes of AI integration. One philosophy: your data stays under your control.

The Vision: AI-Native GRC

Traditional GRC tools were built for humans clicking through menus. AI agents don't need guided workflows or elaborate dashboards. They need structured data they can parse and reason about.

MTC Skopos bridges this gap:

What AI NeedsWhat MTC Skopos Provides
Structured data exportsJSON, CSV optimized for token efficiency
Consistent schemasStable formats that don't change with updates
Real-time data accessMCP server for live queries
Local processing optionWorks with Ollama, LM Studio, any local LLM

The result: ask questions about your SAP security posture in plain English, get answers based on your actual data.

Mode 1: MCP Server Integration

The Model Context Protocol (MCP) server connects MTC Skopos directly to AI assistants like Claude, enabling conversational queries against your SoD analysis results.

How It Works

Instead of querying raw SAP tables (which would consume enormous tokens and exceed context windows), the MCP server connects to MTC Skopos's pre-computed analysis. When you ask a question, the AI gets targeted, complete results instantly.

Example Conversations

"Which Finance risks affect the most users?"

Skopos shows F001 (GL Maintenance + Posting) has the highest user count at 47 users, while F002 (Cost Center manipulation) shows the most transaction activity with 1,247 executions this quarter.

"Show me users with payment conflicts who actually executed both sides"

Based on did-do analysis, 3 users have both created vendors AND processed payments to those vendors in the past 90 days. User SMITHJ has the highest activity with 47 vendor changes and 312 payment transactions.

"If I remove transaction XK01 from role Z_FI_AP, who is affected?"

15 users have this role. Usage analysis shows 3 users actively use XK01 (average 12 executions/month), while 12 users have never executed it. Removing XK01 would resolve SoD conflicts for all 15 users.

"Explain our P2P risks to the CFO"

18 users can both create vendors AND process payments to them. That's like giving someone both the company checkbook and the ability to add recipients. Here's the fraud scenario: Monday they create a vendor for their friend's company, Tuesday they process a payment. Without segregation, there's no control stopping this.

Supported AI Assistants

The MCP server works with any AI that supports the Model Context Protocol:

  • Claude (Desktop app, API)
  • ChatGPT (via MCP-compatible interfaces)
  • Local LLMs (Ollama, LM Studio, etc.)
  • Custom AI agents (any MCP-compatible implementation)

Read the full MCP integration guide

Mode 2: AI-Optimized Exports

Every analysis in MTC Skopos exports to structured formats designed for machine consumption.

JSON Exports

{
  "user": "JSMITH",
  "risk_id": "F071",
  "risk_level": "High",
  "conflicting_access": {
    "function_1": {
      "name": "Maintain Vendor Master",
      "transactions": ["XK01", "XK02"],
      "execution_count": 147,
      "last_execution": "2025-10-15",
      "source_roles": ["ZS:FI:AP-PROCESS:C"]
    },
    "function_2": {
      "name": "Process Payments",
      "transactions": ["F110", "F111"],
      "execution_count": 89,
      "did_do_changes": 23,
      "source_roles": ["ZS:FI:AP-PAYMENTS:C"]
    }
  },
  "remediation_complexity": "medium"
}

Copy this into any AI assistant. Ask questions. Get analysis. No data transformation required.

Token-Efficient Design

We've pre-processed and structured the data to minimize token consumption:

  • Compact field names reduce overhead
  • Pre-aggregated statistics eliminate redundant data
  • Hierarchical structure enables selective loading
  • Consistent schemas mean AI learns the format once

The result: lower AI processing costs and faster responses.

Export Formats

FormatBest For
JSONAI agents, programmatic analysis, MCP integration
CSVSpreadsheet tools, Power BI, Tableau
ExcelManual review, stakeholder sharing

Mode 3: Local LLM for Zero Cloud Exposure

For organizations that want AI capabilities but refuse any cloud data exposure, MTC Skopos works seamlessly with local LLMs.

Complete Privacy

  • Your SAP authorization data never leaves your network
  • Your AI queries never leave your network
  • Complete analysis capability with zero external data transmission

Supported Local LLMs

The MCP server works with any local LLM that supports MCP or can consume structured JSON:

  • Ollama - Run Llama, Mistral, and other models locally
  • LM Studio - Desktop app for running local models
  • LocalAI - OpenAI-compatible local API
  • Any local model - Feed JSON exports directly

Why This Matters

SAP authorization data is sensitive. It reveals:

  • Who can do what in your most critical business systems
  • Organizational structure and reporting lines
  • Potential attack vectors and security gaps

CISOs in regulated industries understand this. Many security teams refuse to send this data to external SaaS platforms, regardless of compliance certifications.

With MTC Skopos + local LLM: that conversation never happens. AI-powered analysis, complete data sovereignty.

Role Designer AI

Describe your requirements in plain English. Get optimized SAP role configurations.

How It Works

Instead of manually configuring authorization objects and values, describe what the role should do:

"Create a role for AP clerks who need to create and modify vendor invoices but not process payments"

The AI generates:

  • Required authorization objects
  • Appropriate field values
  • SoD conflict warnings
  • Suggested mitigating controls

Benefits

  • Faster role design - minutes instead of hours
  • Built-in SoD awareness - conflicts flagged during design
  • Best practice defaults - authorization values based on SAP standards
  • Documentation included - role purpose and scope auto-documented

Prompt Templates

Copy these prompts to get started with AI-powered SoD analysis.

Risk Overview

You are a GRC analyst. I'm providing SAP Segregation of Duties analysis
results in JSON format.

Summarize the key findings:
- Total users with violations
- Most common risk categories
- Users with highest risk exposure
- Recommendations for immediate action

[Paste JSON export here]

Remediation Prioritization

Based on this SoD analysis data, identify the top 10 remediation priorities.

Consider:
- Risk severity (High > Medium > Low)
- Did-do analysis (actual execution > theoretical access)
- Number of affected users
- Business impact of changes

Provide a prioritized list with specific remediation actions.

[Paste JSON export here]

Executive Summary

Create a one-page executive summary of this SoD analysis for the CFO.

Use business language, not technical jargon. Focus on:
- What's the business risk?
- What's the exposure (users, transactions, dollars)?
- What should we do about it?

[Paste JSON export here]

Audit Response

We received an audit finding about Segregation of Duties in our
SAP environment. Based on this analysis data, draft a response that:

1. Acknowledges the finding
2. Shows our current risk posture
3. Presents our remediation plan with timeline
4. Demonstrates monitoring controls in place

[Paste JSON export here]

Getting Started

Step 1: Run Your Analysis

Export your SAP data and run SoD analysis in MTC Skopos. The analysis completes in minutes.

Step 2: Choose Your AI Mode

If you want...Use this mode
Real-time conversational queriesMCP Server
One-time analysis with any AIJSON/CSV Export
Complete privacy, no cloudLocal LLM + MCP or Exports

Step 3: Start Asking Questions

Whether through MCP or by pasting exports, your AI assistant now has access to your actual SAP security data. Ask anything:

  • "What are our highest-risk users?"
  • "Which conflicts have actually been exploited?"
  • "What's the fastest path to SOX compliance?"
  • "Generate a remediation roadmap for Q2"

Why This Approach?

Traditional GRC tools invested heavily in building visualization layers, dashboards, and reporting engines. But:

  • Your organization already has Power BI, Tableau, or other BI tools
  • AI assistants can generate charts on demand
  • Every hour spent wrestling data out of dashboards is an hour not spent on analysis

MTC Skopos takes a different approach: prepare the data, then get out of the way.

We provide clean, structured, AI-ready data. You choose how to analyze it.

Ready to see AI-powered GRC in action? Start your free trial or schedule a demo.