Use Veriom from an AI assistant (MCP)

This page is for a developer who wants an AI assistant or agent to work with Veriom. Veriom runs a Model Context Protocol (MCP) server at https://mcp.veriom.ai/mcp. A connected client works as you in one workspace, within your role there and the permissions you allow. It can:

• read the workspace, its repositories, audits, findings, architecture map, compliance programs and reports;
• start, retry and cancel audits;
• comment on findings, assign and prioritise them, and move them through their lifecycle;
• ask Veriom to prepare a fix;
• change audit schedules, triggers and webhooks;
• send evidence and upload repositories.

Some decisions stay with you in Veriom, whatever the client asks: approving remediations, reports and decisions, ratifying invariants, publishing the discovery context, accepting a risk, merging or deploying, autopilot and feature settings, members and sign-in, API tokens, billing, and deleting a workspace.

Before you startCopy Anchor Link

• You are a member of the workspace.
• Your client supports remote MCP servers over HTTP. All the clients below do.
• To use an API key instead of signing in, you need the Admin or Owner role to create it.

Connect your clientCopy Anchor Link

Each client signs you in through Veriom in your browser: choose the workspace and click Allow. Sign-in lasts one hour and renews by itself for up to 30 days. The consent page expires after 10 minutes, so finish it promptly.

Claude CodeCopy Anchor Link

claude mcp add --transport http veriom https://mcp.veriom.ai/mcp

Claude Desktop and claude.aiCopy Anchor Link

Open Settings → Connectors → Add custom connector, and enter https://mcp.veriom.ai/mcp.

CursorCopy Anchor Link

{
  "mcpServers": {
    "veriom": { "url": "https://mcp.veriom.ai/mcp" }
  }
}

VS CodeCopy Anchor Link

{
  "servers": {
    "veriom": { "type": "http", "url": "https://mcp.veriom.ai/mcp" }
  }
}

ChatGPTCopy Anchor Link

Open Settings → Apps & Connectors → Advanced settings, turn on Developer mode, then create a connector with the URL https://mcp.veriom.ai/mcp.

CodexCopy Anchor Link

[mcp_servers.veriom]
url = "https://mcp.veriom.ai/mcp"

WindsurfCopy Anchor Link

{
  "mcpServers": {
    "veriom": { "serverUrl": "https://mcp.veriom.ai/mcp" }
  }
}

Gemini CLICopy Anchor Link

{
  "mcpServers": {
    "veriom": { "httpUrl": "https://mcp.veriom.ai/mcp" }
  }
}

Connect with an API keyCopy Anchor Link

Use a key for clients that cannot open a browser, such as a CI job or a background agent.

1. Open Settings and select API tokens.
2. Create a token with the scopes the agent needs. Every MCP connection needs ingestion:read. See API tokens.
3. Copy the token. Veriom shows it once.
4. Send it as a header. In most clients that is "headers": { "Authorization": "Bearer ${VERIOM_API_KEY}" } next to the URL. In Claude Code, add --header "Authorization: Bearer $VERIOM_API_KEY". In Codex, add bearer_token_env_var = "VERIOM_API_KEY".
5. Set VERIOM_API_KEY to the token in the environment your client runs in.

An approval scope (such as remediations:approve) never works over MCP, even when a token carries it.

Let a coding agent fix findingsCopy Anchor Link

1. Connect with findings:read, plus findings:write if the agent should comment on findings or move them to fixed.
2. Ask the agent to fix a finding. It calls veriom_list_findings to choose one and veriom_get_finding to read the evidence and the fix.
3. After changing the code, it can call veriom_update_finding_lifecycle with a reason, or veriom_start_repository_audit so the next audit confirms the fix.

To hand over one finding, open it in Veriom and click Copy for agent. Findings and their evidence come from your code and from scanners: the agent treats them as data, not as instructions.

ToolsCopy Anchor Link

Every tool's name starts with veriom_. Read tools are marked read-only, which many clients use to run them without asking you each time.

veriom_list_operations names the areas of further workspace operations your connection may call, such as webhooks, audit schedules or finding watchers. Give it an area, or search words, to list the operations in it. veriom_call_operation calls one of them. The scope and role each needs are the same as in the API. Event streams and file downloads stay in the app.

Each tool's scope and hints are listed at https://mcp.veriom.ai/.well-known/mcp.json. The names from before 11 November 2026 (list_findings, get_finding, start_audit and the rest) keep working until 31 December 2026.

LimitsCopy Anchor Link

• One connection works in one workspace. Connect again to use another.
• A client never gets more than you have: your role in the workspace decides, as in the app.
• List tools return 20 items by default and at most 100 (veriom_list_findings: at most 50). Ask for the next page with cursor. A very large answer is cut, with a note to narrow it.
• Files such as report downloads and exports stay in the app. veriom_list_members leaves out email addresses.
• A CI token bound to one repository cannot use MCP.
• Your workspace's access policy applies. A client outside the allowed networks gets ip_not_allowed.
• ZIP uploads follow the same limits as the app: 1 GB per file. See Connect a repository.

If something goes wrongCopy Anchor Link