Connector review
Trustity MCP connector
A read-only way for an AI assistant to ask the Trustity Cloud Portal about one organization. This page is the public description for directory review.
Endpoint
POST https://www.trustity.io/api/v1/mcp
JSON-RPC 2.0, protocol 2025-06-18, Streamable HTTP. A browser can read the public card at the same URL with GET. No customer data is on that card.
Authentication
- An Owner or Admin turns Customer API on and names approver emails.
- The assistant sends
Authorization: Bearer trst_live_…. - It calls
start_session, the user pastes the emailed code, thenconfirm_session.
The emailed code is required on every new conversation. It turns on with the API and cannot be turned off. The code expires in 10 minutes. The session lasts four hours. Revoking the key ends an open session. The API is off for the organization until that switch is on. For a directory review, Trustity can bind a standing 6-digit code to the review key supplied with the submission. That code confirms a session only together with that key. Customer keys keep the emailed code on every new conversation.
Skill
The connector implements the MCP Skills extension io.modelcontextprotocol/skills. After the API key is accepted, an assistant loads skill://trustity-portal/SKILL.md. That file tells it to start a session, wait for the emailed code, and stay on the four read tools. The skill has no customer data.
Tools
start_session— Emails a one-time code to the approvers named in the portal.confirm_session— Exchanges that code for a four-hour session token.alerts— Recent alerts. Evidence frames are not included.logs— Recent audit events, shortened, with tokens removed.policy— What one named policy enforces. Secrets and file fingerprints are not included.device— Whether a hostname or agent id is in the fleet, plus status and last seen.
The four read tools are marked read-only. None of them change policy, lock a session, rotate a password, or delete data. Unlock codes, vault secrets, file fingerprints, and evidence frames are left out. The assistant vendor sees whatever a tool returns.
Example prompts
- What alerts came in over the last day?
- Summarize what the FileGuard policy enforces.
- Is the device named finance-01 enrolled, and when was it last seen?
Review access
Trustity supplies a review organization, an API key, and an approver inbox with the submission. The key is not published on this page.