CYBO Attest in Claude: Deep Dive¶
How it works¶
Attest is a remote MCP server: a service that publishes a set of tools Claude can call over HTTPS. When you add it as a custom connector, Claude's cloud connects to that server, discovers the tools, and routes your requests through them. Nothing runs on your device, which is why the same connection works on the web, the desktop app, mobile, and Cowork.
Signing in happens once. Claude sends you to Attest's sign in page, you log in with your Attest account and approve the listed scopes, and Attest hands Claude a token tied to your user. Every tool call after that carries the token, so Attest applies your permissions exactly as it would in the console. Claude never sees your password.
Setup and administration¶
Attest is a custom connector (a remote MCP server) in Claude. It is available on every Claude plan; Free accounts are limited to one custom connector. The short version of setup is in Claude: Quick Setup for individual accounts and Claude: Team and Enterprise Setup for organizations. This section covers what that guide leaves out.
Who adds it, and who signs in
| Plan | Who adds the connector | Who signs in to Attest |
|---|---|---|
| Free, Pro, Max | The user, under Customize > Connectors | The same user |
| Team | An Owner or Primary Owner, under Organization settings > Connectors | Each member, individually |
| Enterprise | An Owner, Primary Owner, or a custom role with Manage access to Libraries | Each member, individually |
On Team and Enterprise plans the Owner adds Attest once and it appears in every member's connector list.
Owner steps:
- Open Organization settings > Connectors.
- Click Add, hover Custom, then select Web.
- Name it
CYBO Attest, pastehttps://attest.ulapcybo.app/mcp, and click Continue. - Keep Authentication on Sign in now or Sign in when needed, set OAuth client to Register automatically, leave Request headers empty, and click Add.
Member steps: open Customize > Connectors, find CYBO Attest (it carries a Custom label), and click Connect. Each member clicks Connect and signs in with their own Attest account, so Claude only ever sees what that person can see in Attest. There is no shared credential.
Settings that matter when adding it
- Authentication: Sign in now (the user authenticates immediately) or Sign in when needed (first use). Both work; Sign in now surfaces problems earlier.
- OAuth client: Register automatically. Attest's authorization server supports dynamic client registration, which is what this option uses. Use Claude's published identity is the default Claude suggests, but Attest does not currently recognize that identity, so sign in fails with an unknown client error if you leave it selected.
- Request headers: leave empty. Attest uses OAuth, not API keys.
Changing or removing it
Connectors cannot be edited in place. To change a setting, remove the connector (Customize > Connectors, the three dots next to CYBO Attest, Remove) and add it again. Removing it revokes Claude's access to Attest for that user; on Team and Enterprise plans an Owner removing it under Organization settings revokes it for everyone.
To sign out of Attest without removing the connector, use Disconnect from the same menu, then Connect to sign in again (for example after changing Attest accounts).
Tool reference¶
Attest exposes these tools to Claude. Read tools run without asking. Write tools (marked) change something in Attest, and Claude asks you to allow each one the first time it is used in a conversation. You never call a tool by name; Claude picks the right one from what you ask, and you can see which one it used in the tool card on its reply.
Account and setup
| Tool | What it does | Type |
|---|---|---|
whoami |
Confirms which Attest account Claude is signed in as | Read |
console_link |
Returns a link to the matching page in the Attest console | Read |
list_applications, get_application |
Lists your applications, or returns one in detail | Read |
get_application_config, get_application_progress |
Shows an application's settings and how far it is through the pipeline | Read |
list_intake_applications |
Lists applications still in intake, before their first scan | Read |
get_github, list_github_repositories, add_github_repository |
Shows the GitHub link, lists repos Attest can see, and registers a repo as a new application | Read; add is Write |
retry_provisioning |
Retries setup for an application whose provisioning failed | Write |
remove_application |
Removes an application from Attest | Write |
Base images and Dockerfiles
| Tool | What it does | Type |
|---|---|---|
list_base_images, list_base_image_tags |
Lists approved base images and the tags available for one | Read |
choose_dockerfile |
Selects which Dockerfile in the repo Attest should build | Write |
get_dockerfile_fix |
Proposes a corrected Dockerfile that resolves base image findings | Read |
use_fixed_dockerfile |
Applies the proposed Dockerfile to the application | Write |
Scans and evidence
| Tool | What it does | Type |
|---|---|---|
sync_application |
Pulls the newest commits into Attest's copy, rebuilds, and starts the scans; the rescan after a fix | Write |
start_scan |
Re runs the scans on the build Attest already has | Write |
list_scans, find_scans, get_scan |
Lists scans, searches them, or returns one scan | Read |
list_scan_runs, list_scan_jobs, get_scan_job_log, explain_job |
Shows the runs and jobs inside a scan, their logs, and a plain language explanation of a job | Read |
get_scan_source, get_scan_artifact, get_scan_evidence |
Returns what was scanned, the artifacts produced, and the evidence package | Read |
Findings and fixes
| Tool | What it does | Type |
|---|---|---|
list_findings, get_finding, get_finding_change |
Lists findings, returns one, and gives the exact manifest line and commands that move a vulnerable package to its fixed version | Read |
explain_finding |
Explains a finding in plain language, with remediation context | Read |
plan_fixes |
Produces an ordered fix plan for the open findings | Read |
Justifications
| Tool | What it does | Type |
|---|---|---|
list_justifications |
Lists existing justifications and their status | Read |
draft_justification |
Drafts justification text for a finding | Read |
propose_justification |
Submits a justification for review | Write |
apply_justifications |
Applies approved justifications to the findings they cover | Write |
withdraw_justification |
Withdraws a justification | Write |
Gates, posture, and authorization
| Tool | What it does | Type |
|---|---|---|
get_security_posture |
Summarizes where the application stands against the gates | Read |
explain_gate, explain_gate_controls |
Explains a gate and the controls behind it | Read |
explain_assessment |
Explains the overall assessment result | Read |
get_review, get_review_summary |
Returns the current review and a summary of it | Read |
list_authorization_candidates |
Lists applications ready to request authorization | Read |
get_decision |
Returns the authorization decision for an application | Read |
request_authorization |
Submits an application for authorization | Write |
Workflows¶
The tools follow the Attest pipeline: onboard an application, scan it, work the findings, justify what cannot be fixed, and request authorization. Each stage below gives the prompts that work well and what Claude does with them. Claude chains tools on its own, so one prompt can cover several steps.
1. Onboard an application
- "Which of my GitHub repos can Attest see?"
- "Add the payments-api repo to Attest and tell me when provisioning finishes."
- "Provisioning failed on payments-api. Retry it and show me the progress."
- "Which Dockerfile should Attest build for this app? Use the one in
deploy/."
Claude registers the repo, watches progress, and only moves on once Attest reports the application is ready.
2. Scan
- "I pushed the fix. Scan the latest code of payments-api and follow it until the scans finish."
- "Re run the scans on the current build of payments-api."
- "Is the latest scan on payments-api done? Show me the jobs that failed and explain the first one."
- "Pull the evidence package from the last scan and summarize what it contains."
Starting a scan is a write action, so Claude asks before it runs. Follow up questions about jobs, logs, and evidence are reads and run immediately.
3. Triage findings
- "List the critical and high findings from the latest scan on payments-api."
- "Explain finding [id] like I am the developer who has to fix it."
- "Compare the findings on the newest scan of payments-api with the one before it. What closed, and did anything get worse?"
- "Group the open findings by root cause and tell me which fix clears the most of them."
4. Fix
- "Plan fixes for the open findings on payments-api, ordered by impact."
- "Give me a fixed Dockerfile that moves us to an approved base image." then "Apply it."
- "Which approved base image tags are available for python?"
Claude shows the proposed Dockerfile before applying it. Applying is a write action and needs your approval.
5. Justify what will not be fixed
- "Draft a justification for finding [id]. The vulnerable function is never called in our build."
- "Submit that justification."
- "Show me every justification on payments-api and its status."
- "Apply the approved justifications."
Drafting is a read (nothing changes). Submitting, applying, and withdrawing are writes.
6. Gates and authorization
- "What is the security posture of payments-api? Which gates are failing?"
- "Explain the gate that is blocking us and the controls behind it."
- "Is payments-api ready to request authorization? If so, request it."
- "What was the authorization decision, and why?"
A good end to end prompt for a new application: "Add the payments-api repo to Attest, scan it, then give me the critical findings, a fix plan, and the posture summary." Claude will pause for approval at the write steps (adding the repo and starting the scan) and run the rest on its own.
Permissions and data¶
Claude acts in Attest as you, with the access your Attest account already has, and nothing more.
What you grant at sign in. The consent screen lists the scopes Claude requests:
| Scope | Lets Claude |
|---|---|
applications:read |
See your applications, their configuration, and progress |
applications:write |
Add, configure, retry, and remove applications |
scans:read |
See scans, runs, jobs, logs, evidence, findings, posture, and decisions |
scans:write |
Start scans and apply Dockerfile fixes |
justifications:write |
Draft, submit, apply, and withdraw justifications |
evidence:read |
Download scan evidence and artifacts |
offline_access |
Stay signed in between sessions without re prompting you |
The token Claude receives is tied to your Attest user. If your Attest role cannot see an application, Claude cannot either.
Tool approvals. The first time Claude wants to use a write tool in a conversation it shows an approval card. Allow once approves that call only; Allow always approves that tool for future conversations without asking. Use Allow always only for tools you are comfortable running unsupervised. You can turn individual tools off for a conversation through the + button, then Connectors, then the CYBO Attest entry.
What Attest sees. Attest sees the tool calls Claude makes and the parameters in them (an application name, a finding id, justification text). It does not see the rest of your conversation.
Where the connection runs. Claude reaches Attest from Anthropic's cloud, not from your device, so Attest sees requests from Anthropic's IP ranges regardless of which Claude app you use.
Revoking access. Any of these ends Claude's access immediately:
- Disconnect or Remove the connector under Customize > Connectors in Claude
- Revoke the Claude session from your Attest account settings
- An Owner removing the connector under Organization settings (Team and Enterprise)
Using Attest with Projects, Research, and Cowork¶
Projects. Create a Claude Project per application or per team and put standing context in its instructions: the application names Attest uses, your base image policy, who approves justifications, and the tone you want for justification text. Every chat in the Project then starts with that context, and prompts get shorter ("scan it and give me the criticals" instead of naming the app each time). Upload your security policy or control mappings to the Project's knowledge so Claude can cite them when explaining gates.
Research. Attest works inside Research, and Claude can call its tools repeatedly without asking during a research run. That is useful for questions like "Across all my applications, which findings recur and which base images cause them?" Before starting a Research task, open the Connectors menu for the chat and turn off the write tools (sync_application, start_scan, use_fixed_dockerfile, propose_justification, apply_justifications, withdraw_justification, request_authorization, add_github_repository, remove_application). Research will then read freely and change nothing.
Cowork and Claude Desktop. Attest is available in both with no extra setup once it is added to your account. In Cowork, Attest pairs well with a local checkout of the repo: Claude can read findings from Attest and edit the code on your machine in the same task.
Mobile. The iOS and Android apps use the same connector. Reading posture and findings on your phone works well; approving write actions works too, but reviewing a proposed Dockerfile is easier on a larger screen.
Troubleshooting and FAQ¶
| Symptom | Likely cause | Fix |
|---|---|---|
| Claude answers from general knowledge and never calls Attest | The connector is off for this chat | Click + in the message box, Connectors, toggle CYBO Attest on; or say "use Attest" in the prompt |
| Sign in page shows invalid scopes or unknown client | Connector was added with OAuth client set to Use Claude's published identity | Remove the connector and add it again with Register automatically |
| Sign in loops or hangs | Stale session | Customize > Connectors, three dots next to CYBO Attest, Disconnect, then Connect |
| 401 or 403 on a tool call | Session expired, or your Attest role lacks access to that application | Disconnect and Connect again; confirm your role in Attest |
| Connector missing on a Team or Enterprise account | Only Owners can add custom connectors | Send this page to an Owner |
| Tool card shows an error from Attest | The application is still provisioning, or the scan has not finished | Ask Claude for the application progress or scan status and retry |
| Research changed something unexpectedly | Write tools were left on | Turn off write tools before Research (see above) |
Can I use Attest in the Claude API or with my own agents? Yes. Any MCP client can connect to https://attest.ulapcybo.app/mcp with OAuth. See the separate guides for Claude Code and VS Code.
Does Claude store my Attest data? Tool results appear in the conversation like any other content. Attest itself is not sent your conversations, only the tool calls.
Can I limit which tools Claude may use? Yes, per conversation through the Connectors menu, and permanently by removing the connector and asking your Attest admin to issue a role with narrower access.
Can two people share one connection? No. Each person signs in with their own Attest account, which is what keeps Attest's permissions intact.
Where do I get help? Contact Ulap support with the error text, the tool name from the tool card, and whether you are on an individual or Team plan.