---
title: AI Connector
description: Give an approved AI assistant read-only, permission-scoped access to your compliance data so it can answer posture, SPRS, gaps, evidence, risk, and POA&M questions and guide your CMMC journey.
navigation:
  icon: i-lucide-bot
---

# AI Connector

The **AI Connector** lets you point an AI assistant — such as **Claude** or **ChatGPT** — at your organization's compliance data and ask it questions in plain language. Instead of copying numbers out of the dashboard, you connect the assistant once and it reads your live posture directly: your **SPRS score**, your **open gaps**, your **evidence** and its expiry, your **risk register**, your **POA&M** items, and where you are on your **CMMC journey**.

It is built on **MCP** (the Model Context Protocol), the open standard for connecting AI assistants to external data, and it uses a **secure sign-in (OAuth)** so the assistant only ever acts as you. The connector is **read-only**: an assistant can *read* your data to answer questions and guide you, but it can **never change, create, or delete anything** in your account.

::note
Turn the connector on or off — and revoke connections in an emergency — from **Organization Settings → Security**. Both controls are available to an **Org Admin**. See [Permissions](#permissions).
::

---

## Key concepts

### What the connector is

| Property | Behavior |
| --- | --- |
| **Access mode** | :badge[Read-only]{color="success"} — answers questions; never writes, edits, or deletes |
| **Scope** | Your organization's compliance data only, and only what your role already permits |
| **Standard** | :badge[MCP]{color="info"} (Model Context Protocol), the open assistant-connection standard |
| **Sign-in** | Secure **OAuth** — you sign in and approve access; the assistant acts as you |
| **Control** | Org-wide on/off switch, plus an emergency **Revoke all** |
| **Auditability** | Every request is written to your **activity log** |

### What an assistant can read

An assistant reads your data through a fixed set of named **tools** — each one answers a specific question and nothing more. They are grouped by area below. This is the complete list; there are no hidden read paths.

| Area | Tools |
| --- | --- |
| **Posture & journey** | `get_client_overview`, `get_client_sprs`, `get_client_gaps`, `get_client_readiness`, `get_cmmc_journey` |
| **Assessments** | `list_assessments`, `get_assessment_domains` |
| **Compliance Ops** | `get_compliance_ops_overview`, `get_compliance_ops_history` |
| **Evidence** | `get_evidence_summary`, `get_evidence_gaps` |
| **Risk** | `get_risk_register`, `get_risk_summary` |
| **POA&M** | `get_poam_items` |
| **Systems & assets** | `get_systems`, `get_assets_summary` |
| **MSP portfolio** | `get_msp_clients`, `get_msp_portfolio_brief` |

::note
The **MSP portfolio** tools are available only to Managed Service Provider organizations, and only to members with the MSP management role. A direct organization never exposes them.
::

### What it will not do

| Guarantee | Meaning |
| --- | --- |
| **Never writes** | No tool can change, add, or remove data — the connector has read access only |
| **Never over-shares** | An assistant sees exactly what the connected person's role allows, no more |
| **Never sees raw asset detail** | Asset summaries return counts by category and scope, not individual CUI field values |
| **Never treats your text as commands** | Free text you authored (risk notes, POA&M weaknesses, policy wording) is passed to the assistant tagged as *data*, so it can't hijack the assistant |

---

## Using the connector

### Enable the connector

::steps{level="4"}

#### Open Organization Settings

Go to **Organization Settings → Security**. You'll see the **AI Connector** card. (This card is visible only to an Org Admin.)

#### Turn it on

Flip the **AI Connector** switch on. This allows approved assistants to connect and read your organization's compliance data. It does **not** connect any assistant by itself — each person still connects their own.

::

::tip
The switch is an organization-wide gate. While it's on, individual members connect their own assistants and each still sees only what their role permits. While it's off, **no** assistant can read anything, regardless of who is signed in.
::

### Connect an AI assistant

::steps{level="4"}

#### Add DIBFI as a connector in your assistant

In your AI assistant (for example, Claude or ChatGPT), add DIBFI as an MCP connector using the address your DIBFI administrator provides.

#### Sign in and approve access

The assistant sends you to a **secure sign-in**. You sign in as yourself and **approve** the connection on a consent screen. This consent step is what authorizes *that specific assistant* to read on your behalf — nothing connects without it.

#### Ask your questions

Once approved, ask in plain language — "What's my SPRS score?", "Which practices are still failing?", "What evidence is expiring soon?", "What's the next best action on my CMMC path?" The assistant calls the matching read tool and answers from your live data.

::

::note
Because the assistant acts **as you**, it inherits your permissions automatically. If you can't see billing or MSP data in the app, neither can your assistant.
::

### Disable the connector

Turn the **AI Connector** switch **off** in **Organization Settings → Security** at any time. This is an immediate **kill switch**: every assistant loses read access right away, and no new connections can be made until you turn it back on.

### Revoke all connections (incident response)

If you suspect a problem — a leaked connection, or an assistant you don't recognize — use **Revoke all connections**.

::steps{level="4"}

#### Open the Security card

In **Organization Settings → Security**, find the **Revoke all connections** panel.

#### Confirm the revoke

Confirm the action. Every existing connection is **immediately invalidated** and the connector is turned **off**. Anyone who wants to reconnect must sign in and approve access again from scratch.

::

::warning
**Revoke all** cannot be undone. Re-enabling the connector later will **not** restore the old connections — they're gone, and each person must reconnect with a fresh sign-in. Use the plain **off** switch for a routine pause; reserve **Revoke all** for a genuine security concern.
::

---

## Permissions

Managing the connector is limited to organization administrators; what an assistant can *read* is governed by the connected member's own role.

| Capability | Who |
| --- | --- |
| Turn the connector on/off, revoke all connections | :badge[Org Admin]{color="info"} |
| Connect an assistant and read data | :badge[Any member]{color="neutral"}, scoped to their own role |
| Read MSP portfolio tools | :badge[MSP management role]{color="warning"} only |

::warning
Enabling the connector never widens anyone's access. It simply lets an assistant read, on a member's behalf, the same data that member could already open in the app. A viewer's assistant sees a viewer's view.
::

---

## How it works

Extra detail on how the connector behaves — product behavior, not internals.

### Read-only by design

Every tool in the connector answers a question by reading your data and returning a summary. There is no tool that writes. An assistant can tell you that a POA&M is overdue, but it cannot change its date; it can list expiring evidence, but it cannot upload, edit, or delete a file. Any action you want taken still happens in the app, by you.

### The security model

The connector is built around a few guarantees that hold on every single request:

:::field-group
::field{name="Permission parity"}
An assistant is admitted with **your** identity and resolves **your** role fresh on every request. Each tool requires the same permission its in-app equivalent does, so an assistant can never read something you couldn't open yourself.
::
::field{name="Organization kill switch"}
An Org Admin can disable the connector for the whole organization. While it's off, every request is refused before any data is read.
::
::field{name="Revoke all"}
In an incident, an Org Admin can invalidate every existing connection at once and disable the connector. Previously connected assistants lose access immediately and must reconnect with a new sign-in.
::
::field{name="Consent at sign-in"}
Which assistant may connect is decided by **you** at a consent screen during secure sign-in. Nothing gains access silently.
::
::field{name="Full audit trail"}
Every request is recorded in your **activity log** — who connected, which tool ran, and whether it was **allowed** or **blocked** (and why). Blocked attempts are logged distinctly so they're easy to spot.
::
::field{name="Injection-safe text"}
Text your team authored — risk notes, POA&M weaknesses, policy language — is handed to the assistant explicitly marked as *data, not instructions*, so a crafted note can't turn into a command the assistant follows.
::
:::

### Consistent, structured answers

Each tool returns its data in a consistent, structured form that includes standards-aligned fields where a mapping to **OSCAL** exists, alongside DIBFI's own metrics. This is why an assistant can reliably distinguish, say, a **practice-level** count (a practice is implemented only when *all* its objectives are met) from an **objective-level** count — the distinction is carried in the data, not left to guesswork.

### Fair-use limits

To keep the connector responsive, requests are **rate-limited** per connection. If an assistant asks for too much too quickly, it's asked to slow down briefly and then continues — your data is never at risk, and normal question-and-answer use is well within the limits.

---

## Related features

:::card-group

::card{title="Risk Management" icon="i-lucide-shield-alert" to="https://app.dibfi.com/dashboard/risk"}
The register and posture that `get_risk_register` and `get_risk_summary` read.
::

::card{title="POA&M" icon="i-lucide-list-checks" to="https://app.dibfi.com/dashboard/poam"}
The remediation items surfaced by `get_poam_items`.
::

::card{title="Evidence Library" icon="i-lucide-folder-check" to="https://app.dibfi.com/dashboard/evidence"}
The evidence and expiry data behind `get_evidence_summary` and `get_evidence_gaps`.
::

:::