The server exposes nine tools. An AI client calls them on your behalf, so you rarely name them directly, but knowing what exists tells you what you can reasonably ask for.
Every tool validates the licence before doing any work.
Session and discovery
| Tool | Purpose | Parameters |
|---|---|---|
init_session | Starts the session and lists configured data sources with their system types. Call this first | none |
list_analysis_logs | Lists available analysis logs, user-analysis*.log and roles-analysis*.log | date as YYYY-MM-DD or today; today; recent, defaulting to 10; limit; user; role; system |
Analysis results
| Tool | Purpose | Parameters |
|---|---|---|
summarize_analysis | Summarizes one or more logs: risk counts, impacted entities, and the selection criteria the run used | one or more log filenames |
get_analysis_detail | Detailed report rows from a log | analysis_log; optional user_or_role, risk_id, limit |
get_users_or_roles_triggering_risks | How many users or roles are impacted, by risk ID, business process, or risk level | risk ID, business process, or risk level |
Remediation
| Tool | Purpose | Parameters |
|---|---|---|
get_remediation_report | Generates remediation output for one risk from an analysis log | analysis_log, risk_id |
Role and permission queries
These run against a loaded data source rather than an analysis log, so they work even where no analysis covers the question.
| Tool | Purpose | Parameters |
|---|---|---|
find_roles_by_criteria | Roles and composite roles held by a user that match given permission criteria | user, plus permission criteria |
find_single_roles_by_permission_criteria | Single roles exposing given permission criteria, with an assignment summary | permission criteria |
describe_role | Full description of a role: structure, permissions, memberships | role name |
find_roles_by_criteria accepts either the canonical user ID that analyses report or a system account name, and returns matches per account the user holds. This matters in a cross-system landscape where the same person has several account names. See Cross-System Analysis.
What is not here
The MCP server reads completed analyses and loaded data sources. It does not run an analysis, change criteria, or write anything back to your ERP or IAM system. Run the analysis in the application, then query it here.