The MCP server is most useful for the questions that are awkward in a table: ones that need several results joined, or a judgement about which finding matters. You ask in plain language and the client picks the tools.
The basic sequence
init_sessionto load the data source list. Always firstlist_analysis_logsto find the run you mean, filtered by date, system, or modesummarize_analysisfor the shape of the result: counts by severity, impacted entities, and the criteria the run actually usedget_analysis_detailorget_users_or_roles_triggering_risksto drill into a specific risk or entityget_remediation_reportfor what to do about a given riskdescribe_role,find_roles_by_criteriaorfind_single_roles_by_permission_criteriafor role-level questions
Steps 2 and 3 are worth insisting on. Reading the criteria back before interpreting numbers is what stops a narrowly scoped run being reported as a clean system.
Example: triage this quarter's run
"Load the Skopos session, find today's user analysis for the production system, and summarize it. Then list the five risks affecting the most users and tell me which single role contributes to most of them."
The client calls init_session, then list_analysis_logs with today and system, then summarize_analysis, then get_users_or_roles_triggering_risks per candidate risk, and finally find_single_roles_by_permission_criteria or describe_role to identify the shared role. The useful part of the answer is the last step: one role explaining several risks is one change instead of many.
Example: prepare a remediation proposal
"For risk F001 in the latest analysis, generate the remediation report, then tell me which changes are user-level and which need a role owner to approve."
list_analysis_logs, then get_remediation_report for F001. The split you asked for maps onto the recommendation types: user assignment changes affect one person, while composite and role edits affect every holder. See Understanding Recommendations.
Example: answer a question no analysis covers
"Which single roles grant change access on F_BKPF_BUK, and how many users hold each?"
This goes to find_single_roles_by_permission_criteria against the loaded data source, with no analysis log involved. Useful when someone asks about an authorization that no current ruleset happens to cover.
Example: check one person
"What roles does JSMITH hold that give posting access, and does any of them appear in an open risk?"
find_roles_by_criteria for the permission question, then get_analysis_detail filtered to that user. Note that the user parameter accepts either the canonical ID or a system account name, so both work in a cross-system landscape.
Practical notes
- Ask for a summary before asking for detail. Detailed reports are large, and a client that pulls detail first fills its context with rows before reaching the question
- Name the log when you mean a specific run. Otherwise the client picks one, and "the latest" is not always the one you meant
- The server cannot run an analysis. If the answer needs different criteria, run it in the application and then ask again
- Verify anything you intend to act on against the application. The model is reading your data, but it is still summarizing it