Developers · MCP server
Your compliance program, inside your AI client.
Screenata’s hosted MCP server connects Claude Code, Cursor, and other MCP clients to your workspace. Your agent can see what’s failing, apply a fix you approve, re-run the check, and draft a policy from your answers, with a permission for every tool and every call logged.
Claude Code v2.1
Opus 5 · screenata MCP connected
~/acme/platform
What your agent can do
Read, fix, verify, and draft.
Read the program
Readiness, controls and tests, evidence gaps, risks, policies, and what to work on next. For a failing test, the agent gets the last run, the open finding, the failing resources, and what an auditor will ask for, so it can judge the fix before proposing one.
- Pre-audit check with blockers and warnings
- Search your workspace documents
Re-run the check after a fix
When the agent or your team has changed something, the agent asks Screenata to re-run the check on our servers. A pass closes the finding. The agent never writes a status itself, so a pass always comes from the check.
- Wait for the result inline, or poll the run
- Failing resources returned per run
Fix with approval and undo
Screenata prepares a plan: the steps, the current and proposed state, side effects, and whether it can be reversed. Nothing changes until you approve that exact plan in the conversation. Screenata snapshots the state first, re-runs the check to validate, and can roll the change back.
- Applied by Screenata for supported AWS, Azure, GCP, GitHub, and Microsoft 365 checks, when you have given that connection write access
- Otherwise the plan comes back for your agent or your team to apply
Draft policies from your answers
Each policy is built from a set of questions tied to the framework requirements it serves. The agent asks you the open ones, records only answers you actually gave, and queues a draft generated from them. Drafts are never approved over MCP; you review and approve them in the app.
- Replacing an approved policy needs your explicit agreement
Submit evidence and assign work
Submit text evidence against a test, such as a command's output or a config export, with a dry run to preview it first. Trigger a scan of a connected provider, or assign a test to a teammate by email.
- Screenshots and PDFs go through the screenata CLI
Start with a free assessment
Before you connect anything permanently, the agent can create a temporary read-only connection to AWS, Azure, Google Cloud, Microsoft 365, or GitHub from tokens minted on your machine, run the infrastructure assessment, and read the results. The tokens expire in about an hour.
- Nothing is scheduled against a temporary connection
Setup
Connect in one command.
Claude Code
claude mcp add --transport http screenata https://api.screenata.com/mcp/<workspace-slug>Then run /mcp in Claude Code to sign in.
Cursor, Windsurf, and other clients (mcp.json)
{
"mcpServers": {
"screenata": {
"url": "https://api.screenata.com/mcp/<workspace-slug>"
}
}
}Permissions and security
Your agent gets exactly the access you approve.
OAuth sign-in, per workspace
Your client opens a browser window on first connection. The approval screen lists every permission requested and flags write access. A token works for one workspace only.
A permission for every tool
A client that asks for nothing specific gets read access plus evidence submission. Running checks, applying fixes, drafting policies, triggering scans, and assigning tasks each need their own permission.
Every call logged
Each request is recorded in your workspace's API audit log with the tool that ran, alongside CLI and API traffic.
Your connections stay read-only unless you say otherwise
Screenata only applies a fix on a connection you have given write access, and only after you approve the plan. Read-only connections still get the plan, for you to apply your own way.
Questions
The MCP server, answered.
Does Screenata have an MCP server?
Yes. It is hosted, so there is nothing to install or run. Point your MCP client at your workspace's server URL, sign in with OAuth in the browser, and approve the permissions you want the client to have.
Which AI clients work with it?
Claude Code, Cursor, Windsurf, and other MCP clients that support remote servers over HTTP with OAuth sign-in.
Is the Screenata MCP server read-only?
No. By default a client gets read access plus evidence submission. With the matching permissions it can also re-run checks, prepare and apply fixes, draft policies, trigger scans, and assign tasks. Each of those is a separate permission you approve.
Can an AI agent change my cloud infrastructure through it?
Only through a fix you approve. Screenata applies a fix itself only when the connection has write access and you have approved the exact plan in the conversation. It snapshots the state first and can undo the change. On a read-only connection, the plan comes back for you to apply.
Can an agent mark a control as passing?
No. There is no tool that writes a test status. A finding closes when the check re-runs on Screenata's servers and passes, the same way it does in the app.
Is the MCP server included in my plan?
Yes. The MCP server, the CLI, Slack, email, and GitHub are included in every plan. A free assessment account gets the assessment permissions only until the workspace is activated.
Book a walkthrough
See the loop run on your own stack.
We’ll connect a workspace and take a failing test from the plan to the re-run with your agent.