What the agent can do

The endpoint https://declarable.io/api/mcp offers six tools. The agent picks them; you ask in plain words.

• list_products: Lists the products your key can see, with the current release and how many vulnerabilities are open. A key made for one product lists only that product.
• product_status: One product: its current release, the open vulnerability counts by decision, severity and match confidence, and the gaps found in the current SBOM.
• open_vulnerabilities: The vulnerabilities nobody has closed in the current release, with the components they were matched on and the evidence. A match is a name-and-version comparison against public databases; it does not prove the product is affected.
• record_decision: Writes a decision on one vulnerability match to the product record, under the key’s name: the record shows which key decided, and when. It records your statement; it does not check that it is right.
• article_14_deadlines: Works out the Article 14 reporting dates (24 hours, 72 hours, final report) from the moment you became aware. Dates only: it files nothing and tells nobody.
• document_status: Where each of the product’s documents stands: not started, draft, ready for review, adopted or issued. It says what you have done, not that anyone has checked the document.

Make a key

In your product’s Settings, make an API key and tick only the scopes you want the agent to have. products:read alone is read-only: the agent can look, and cannot change anything. triage:write (“Record decisions” in the form) lets record_decision write. A key made for one product reaches only that product. Keep the key in your secret store, never in a repository.

The agent shares the key’s bucket of 120 requests with everything else using that key, and every request to /api/mcp takes one, the handshake included. Give an agent its own key so a CI job keeps its 120.

Paste one config

Each sends your key as a Bearer header. Formats were read from the vendors’ own pages on 14 October 2026; they change, so check the page if a config is refused.

claude mcp add --transport http declarable https://declarable.io/api/mcp \
  --header "Authorization: Bearer $DECLARABLE_API_KEY"

{
  "mcpServers": {
    "declarable": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://declarable.io/api/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer <your-api-key>"
      }
    }
  }
}

{
  "mcpServers": {
    "declarable": {
      "url": "https://declarable.io/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:DECLARABLE_API_KEY}"
      }
    }
  }
}

{
  "inputs": [
    {
      "type": "promptString",
      "id": "declarable-key",
      "description": "Declarable API key",
      "password": true
    }
  ],
  "servers": {
    "declarable": {
      "type": "http",
      "url": "https://declarable.io/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:declarable-key}"
      }
    }
  }
}

ChatGPT: its connectors are set up in ChatGPT’s own settings, and which of them accept a Bearer header depends on your plan and changes. Check OpenAI’s connector page for the current steps, and use the URL above.

Three things to ask

• “What is open on <product>?”
• “Mark CVE-… not affected because the code is not compiled in.”
• “If we learned of exploitation at 09:00 Berlin today, when are the three reports due?”

The second one needs triage:write. The third works with any valid key.

What it never does

• Upload an SBOM. Uploads stay with the upload route and your CI.
• File anything with ENISA or a national authority. You send the reports.
• Say your product is in line with the Act. The tools report what is in your record and the dates the Article says.

The same decision write, without an agent

A script can record a decision with one request. Needs a key with triage:write.

curl -X POST -H "Authorization: Bearer $DECLARABLE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "status": "not_affected", "justification": "code_not_reachable", "note": "The TLS server code is not built into this image." }' \
  "https://declarable.io/api/v1/products/<product-id>/vulnerabilities/<match-id>/decision"

Full request and answers are in the API reference.