MCP connector (Claude, ChatGPT, Mistral…)

The TechWatchAlert MCP connector lets your AI assistant read your monitoring data and act on your cases, with your permissions, from a conversation: “which exploited CVEs affect the Production project?”, “am I affected by CVE-2024-3400?”, “move this case to remediation and assign it to Sophie”.

It is built on the Model Context Protocol, an open standard: it works with Claude (claude.ai, desktop, mobile, Claude Code), ChatGPT, Mistral Le Chat, Cursor, VS Code and any client that accepts a remote MCP server with OAuth sign-in. Every client goes through the same TechWatchAlert authorization screen and shows up separately in your connected apps.

Who: any user of a TechWatchAlert organization. No specific plan is required to connect; each tool applies the organization plan’s rules (for instance, case management is not included in Free).
Server URL: https://mcp.techwatchalert.com/mcp

Installing the connector

In Claude (claude.ai, desktop, mobile)

In Claude, open Customize › Connectors and choose Add custom connector. On a Claude Team or Enterprise plan, an owner of the Claude organization adds it.
Name it TechWatchAlert and enter https://mcp.techwatchalert.com/mcp. Leave the client ID fields empty: Claude identifies itself.
Click Connect. A TechWatchAlert window opens: sign in if needed (two-factor authentication included).
On the Authorize an application screen, check the application (claude.ai), choose the organization to connect and the permissions, then click Allow.
In a conversation, enable the connector from + › Connectors.

In Claude Code

claude mcp add --transport http techwatchalert https://mcp.techwatchalert.com/mcp

Then run /mcp in a session and choose techwatchalert to authenticate: the browser opens the same authorization screen. Claude Code receives the authorization on your computer (a localhost address): the screen shows a warning, which is expected in this case.

In ChatGPT

In ChatGPT’s settings, add a custom MCP connector (app) with the URL https://mcp.techwatchalert.com/mcp and OAuth authentication; depending on your ChatGPT plan, you may need to turn on developer mode first. ChatGPT then opens the TechWatchAlert authorization screen. The exact location of these settings changes over time: see OpenAI’s help.

In Mistral Le Chat

In Connectors, add a custom MCP connector with the URL https://mcp.techwatchalert.com/mcp, then sign in: Le Chat opens the TechWatchAlert authorization screen. See Mistral’s help for the exact location on your plan.

In Cursor

Add the server to ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "techwatchalert": { "url": "https://mcp.techwatchalert.com/mcp" }
  }
}

Cursor then offers to sign in: the browser opens the authorization screen.

In VS Code (GitHub Copilot)

Add the server to .vscode/mcp.json (or use the MCP: Add Server command):

{
  "servers": {
    "techwatchalert": { "type": "http", "url": "https://mcp.techwatchalert.com/mcp" }
  }
}

Other MCP clients

Any client that speaks the Streamable HTTP transport and the MCP specification’s OAuth 2.1 authorization works: it discovers the authorization server on its own (/.well-known/oauth-protected-resource), registers (client ID metadata document or dynamic registration) and opens the authorization screen. No client ID or key to enter.

The authorization screen

The screen shows:

The application asking for access, by its address (claude.ai), and the name it gives itself, second: a name is self-declared, an address is not. The screen also says where the authorization will be sent; if only to your computer, a warning reminds you to accept only if you just started the connection yourself.
The organization to connect. A connection covers one organization; to use another, reconnect the connector and choose it.
Requested permissions:
- Read your monitoring data (lecture, required): projects, stack, alerts, cases, deadlines, end of life, statistics, CVE database;
- Act on your cases and stack (ecriture): change a status, assign, comment, add or remove a component. The assistant only asks for it when it is about to use a write tool; you can untick it;
- Stay connected (offline_access): access renews without asking you again.

Tools

Read (assistants usually run these without confirmation):

Tool	What it does
`list_organizations`	Your organizations, your role, the plan, and which one is connected
`list_projects`	Accessible projects, with stack size and open alerts by severity
`get_project_stack`	A project’s watched components (version, threshold)
`search_cves`	CVE database search: text, severity, exploited/KEV, EPSS, CVSS, fix, workaround, period
`get_cve`	A CVE record: scores, exploitation, affected and fixed versions, interim mitigations, CERT advisories, references, impact on your projects
`check_cve_exposure`	“Am I affected?”: the CVE against your projects, with the “Why this alert?” explanation
`list_project_alerts`	A project’s alerts, filtered (status, severity, exploited, KEV, deadline, assigned to me)
`get_alert_case`	A CVE case: status, exception, assignees, deadline, history, comments
`list_remediation_deadlines`	Remediation deadlines (NIS2) and the on-time rate
`list_end_of_life`	End-of-life and end-of-support dates of followed releases or the stack
`get_exposure_stats`	Exposure figures per project and in total
`list_fix_actions`	Fix actions: open cases grouped by component and target version, exploited first

Write (the tools are marked as modifying data: assistants usually ask for confirmation):

Tool	What it does
`update_case_status`	Changes a case status; “Mitigated” requires the measure, a justification and an end date; “Accepted risk” goes through the NIS2 register where it applies
`assign_case`	Adds, replaces or removes assignees (by email, or “me”)
`add_case_comment`	Adds a comment to the case thread
`add_stack_component`	Adds a product or vendor to the stack (with version)
`remove_stack_component`	Removes a component from the stack — the only destructive tool

There is no generic tool and no bulk action. Each action goes through the same checks as the app and is recorded in the organization’s audit log.

Example requests

“List the exploited critical alerts of the Patient portal project that are not handled yet.”
“Am I affected by CVE-2021-44228? If so, which version should I install?”
“Which remediation deadlines are overdue this week?”
“Which stack components reach end of life within 90 days?”
“Move CVE-2024-3400 to remediation on Production, assign it to me and add the comment: patch planned Thursday.”
“Add nginx 1.24.0 to the stack of the Website project.”

Revoking access

Yourself: Settings › Connected apps lists your accesses (application, organization, permissions, last use); Revoke cuts access immediately.
An organization administrator: Organization settings › API › Connected apps lists all members’ accesses and can revoke them.
Removing someone from the organization, or deactivating their account, also cuts their accesses.

Granting and revoking appear in the organization’s audit log.

Data and privacy

TechWatchAlert only receives tool calls (tool name and parameters), never the rest of your conversations, and never reads your assistant’s memory or history.
Access tokens are opaque and stored hashed; an access token lives one hour, a refresh token 30 days and changes on every use.
Tool responses stay in your conversation, under the rules of your assistant’s provider (Anthropic, OpenAI, Mistral…).

See the privacy policy.

Troubleshooting

The client cannot connect (“Couldn’t reach the MCP server”, “Authorization failed”…): check the exact URL (https://mcp.techwatchalert.com/mcp, no trailing slash) and click Connect again.
“Your … plan does not include …”: the feature is not part of the connected organization’s plan.
“You do not have the … permission on project …”: ask a project administrator for it.
Wrong organization: revoke the access, then reconnect choosing the right one.
Support: support@techwatchalert.com.