Documentation · Sorvek Bridge

Your AI client, connected to Sorvek with read-only access.

Sorvek Bridge is the MCP (Model Context Protocol) server that lets a compatible client query your inventory, findings and posture without taking action or making changes.

Open app.sorvek.com Need help?

Sorvek Bridge page with read-only MCP keys and configuration examples. — Sorvek Bridge configuration inside the product.

Before connecting your client.

You need Sorvek SaaS Discovery active for your organization, then a Sorvek Bridge API key created by an administrator under Settings → API keys. MCP keys start with skv_mcp_… and are displayed only once.

Server URLhttps://app.sorvek.com/mcp

TransportStreamable HTTP

AuthenticationAuthorization: Bearer <key>

Set up the client your team already uses.

Keep the key in a secrets manager. Do not put it in a committed file.

Claude Code

terminal

claude mcp add --transport http sorvek https://app.sorvek.com/mcp \
  --header "Authorization: Bearer $SORVEK_MCP_KEY"

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "sorvek": {
      "url": "https://app.sorvek.com/mcp",
      "headers": { "Authorization": "Bearer ${env:SORVEK_MCP_KEY}" }
    }
  }
}

If interpolation ${env:…} fails in some versions of Cursor for remote servers, use a mcp.json local file that is not committed.

Microsoft Copilot Studio

Add an existing MCP server using the Streamable HTTP, the URL above and an API key sent in the Authorization header with the value Bearer <your key>.

Claude Desktop

Claude Desktop remote connectors require OAuth (planned for Sorvek V2). In the meantime, use the bridge mcp-remote in Developer → Local MCP servers.

claude_desktop_config.json

{
  "mcpServers": {
    "sorvek": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://app.sorvek.com/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer skv_mcp_votre_cle"
      }
    }
  }
}

Do not add an entry url: in claude_desktop_config.json : Claude Desktop does not support this field. The form Authorization:${AUTH_HEADER} (with no spaces around :) works around a known issue in Claude Desktop for Windows and Cursor.

The 13 tools available.

They query the tenant linked to your key. Access remains read-only.

get_overview

KPIs: total apps/accounts, new apps over 30 days, AI apps, top users, latest scan

list_shadow_apps

Paginated shadow IT inventory (search, category, risk, approval, date)

get_app

Complete app record: metadata, accounts and related findings

list_findings

Security findings from the latest scan (severity filter)

list_users

Employees ranked by SaaS footprint (MFA, admin roles, risk)

get_user_footprint

Complete SaaS footprint of an employee (by email)

list_oauth_integrations

OAuth integrations aggregated by app, risk score and scopes

get_shadow_ai_summary

Scored Shadow AI summary (OAuth + browser extension, DLP leaks)

list_ai_agents

AI agent inventory (Copilot Studio + OAuth heuristic)

get_security_posture

Posture rollup: SSO, MFA, Conditional Access, breaches, findings

list_external_assets

External surface: subdomains, takeover risk

list_recent_events

Activity log: new apps, signups, scans

list_breach_alerts

Vendor breach alerts matched against your apps

Example questions: “Which unapproved AI apps appeared this month?” · “Which at-risk employees have sensitive OAuth grants?” · “Are any subdomains at risk of takeover?”

Limits and security.

Connecting an AI provider remains your organization’s choice. Evaluate what data may reach that provider against your internal obligations.

60 calls per minute per key

Beyond this limit, the client receives an explicit message and can retry.

Scoped to your organization

Each key is linked to your tenant: tools only see your data, from the active data source.

Immediate revocation

From Settings → API keys, the key is invalid on the next request. Each call is logged (tool, status, duration), and identifying parameters are redacted from the log.

Data and prompt injection

Some tools may return employee data. Observed content is not an instruction; use an AI client with appropriate prompt-injection protections.

Connect your AI client with the right level of control.

Sorvek Bridge is included in SaaS Discovery. Start by reviewing scope and keys with an administrator in your organization.

Get started with Sorvek Technical question