Usage examples

How clients use the MCP server

These examples are based on real usage patterns from our clients. Each one is a natural-language prompt you can give your AI assistant (Claude, Cursor, Copilot, ChatGPT, and others) once the MCP server is connected.

Documents and policies

Document work is the most common use. Clients find, read, and update policies and procedures without leaving their assistant.

Find and read a document

"Find our network segmentation policy and show me its current content."

The assistant locates the document with documentFind, then reads the full text with documentGetContent. For meaning-based questions like "where do we describe our incident-response timeline?", it uses documentSearch (semantic search) instead.

Update a section of a document

"In the password policy, change the minimum length requirement from 8 to 12 characters."

The assistant reads the current text with documentGetContent, then applies a precise change with documentEdit.

Check and approve policy coverage

"Which document is our access control policy, and has it been approved?"

Uses documentClassificationFind to show which document fulfils that policy and its approval state. To sign it off — "Approve the access control policy classification." — the assistant calls documentClassificationUpdate.

Compliance controls

Find controls by topic

"List our access-control requirements that apply to remote workers."

The assistant calls controlFind with the relevant search text and category.

See which controls mitigate a risk

"Which controls do we have that mitigate the risk of unauthorised remote access?"

The assistant finds the risk with riskFind, then lists the controls linked to it with controlFind.

Risks and risk assessments

In Tidal Control a risk is the threat you're tracking; a risk assessment records its impact and likelihood scores over time.

Add a new risk

"Add a new risk for the SCADA upgrade project: an external attacker reaching OT network zone 3."

The assistant calls riskCreate with the name and description.

Score a risk

"Assess that risk — impact 4, likelihood 3, treatment reduce."

The assistant calls riskAssessmentCreate to record the impact, likelihood, residual scores, and treatment.

Revise a score after remediation

"We've finished the patch cycle on the unpatched HMI firmware — lower its residual likelihood from high to medium."

The assistant locates the current assessment with riskAssessmentFind, then updates the score with riskAssessmentUpdate.

Review risks by residual level

"Show me all risks with a high residual rating in the vendor-access category."

Uses riskFind filtered by residual risk level.

Assets

Set CIA ratings

"Set the confidentiality, integrity, and availability of the customer database to 5, 4, and 5."

The assistant calls assetUpdate with the CIA scores.

Set recovery objectives

"Give the billing platform a 4-hour RTO and a 1-hour RPO."

Uses assetUpdate to set the recovery time and point objectives.

Adjust a group of assets

"For every cloud-resource asset, set the availability rating to 4."

Uses assetUpdate once per matching asset.

Vendors

Add and assess a vendor

"Add Acme Industrial as a new vendor — they supply the network switches for our OT environment — and start a vendor assessment with medium criticality and EU jurisdiction."

The assistant creates the vendor with vendorCreate, then scaffolds the assessment with vendorAssessmentCreate.

Tasks and activities

Tidal Control's work items are issues (findings and gaps), assessments (reviews and audits), and executions (scheduled control runs).

Review open findings

"Show me all open issues created in the last 30 days."

Uses activityFind filtered by type and date range.

Find overdue control runs

"Which control executions are overdue?"

Uses activityFind filtered by execution type and overdue status.

Turn findings into linked tasks

"Create issue tasks for each of these 12 audit findings and link them to control AC-01."

The assistant calls activityCreateIssue for each finding and links them to the control.

Automated tests

"Which automated tests are currently failing, and which controls do they cover?"

Uses testFind filtered by status. For pass/fail history over time, the assistant follows up with testResultFind.

Tips for the best results

• Be specific about scope. Mention project names, asset identifiers, zones, or categories when you have them — the tools use these to filter accurately.
• Chain operations naturally. You don't need to call tools one by one; describe your goal and the assistant sequences the right tools.
• Mutations ask for confirmation. Your AI client may prompt before running a change (updating a score, creating a record, deleting something). This is expected.
• Your permissions apply. A read-only user can read through the MCP but can't create or change records — exactly as in the portal.
• Approved policies are protected. Editing the approved version of a policy is blocked over MCP; amend the draft in the portal's policy editor.

Tool reference

Tool	Type	What it does
documentSearch	Read	Semantic search across document content
documentFind	Read	List or locate documents by name or type
documentGetContent	Read	Retrieve a document's full text
documentEdit	Mutating	Apply a precise inline change to a document's text
documentUpdate	Mutating	Replace a document's whole body
documentClassificationFind	Read	See which document fulfils which policy, and its approval state
documentClassificationUpdate	Mutating	Approve or revoke a policy classification
controlFind	Read	Search controls; filter by risk, framework, or category
riskFind	Read	List risks; filter by residual level, treatment, or links
riskCreate	Mutating	Create a new risk
riskAssessmentFind	Read	List a risk's assessments (its score history)
riskAssessmentCreate	Mutating	Score a risk: impact, likelihood, residual, treatment
riskAssessmentUpdate	Mutating	Revise an assessment's scores or treatment
assetUpdate	Mutating	Update asset fields: CIA scores, RTO/RPO, category, dates
vendorCreate	Mutating	Add a new vendor
vendorAssessmentCreate	Mutating	Assess a vendor: access, criticality, jurisdiction, rating
activityFind	Read	List compliance tasks — issues, assessments, executions
activityCreateIssue	Mutating	Create an issue (finding) task
testFind	Read	List automated tests and their pass/fail status
testResultFind	Read	Historical pass/fail results for a test