Using PAA from your AI tools (MCP)

Connect PAA to Claude Code and other MCP-compatible AI clients so you can query your findings, posture, and compliance from the tools you already work in.

PAA exposes its architecture and security intelligence as an MCP (Model Context Protocol) server. That means any MCP-compatible AI client — Claude Code, and other agentic development tools — can call PAA directly, so you can ask about your estate from inside the tool you already work in, without opening the platform.

Instead of switching to PAA to check something, you can ask your assistant “what are my open critical findings?”, “explain finding X and how to fix it”, or “evaluate this Bicep before I deploy it” — and it answers from your live PAA data.

What you can do

Once connected, your AI client can use PAA’s tools on your behalf. They fall into three groups:

  • Security — search your open findings (by severity, framework, or keyword), get the full detail and remediation for any finding, read your compliance readiness across frameworks, read your Zero Trust maturity by pillar, run and poll an attack-path analysis, generate an audit-ready compliance evidence pack, and file (or list) a risk-acceptance exception.
  • Cloud engineering — read your overall posture score and the items that need attention now, look up any security check by ID, pull a remediation playbook for a finding, and evaluate a Bicep, Terraform, or ARM snippet inline against PAA’s Well-Architected and Azure Policy rules before you deploy it.
  • Architecture — read your Well-Architected health by pillar, your architecture reconciliation (documented model versus observed reality, with drift), and the grounded WAF/CAF recommendations for a reconciliation run.

Everything is read-oriented. The one tool that can create anything — filing a control exception — only ever raises a pending request; a human approver still has to action it in PAA. Nothing an AI client does through MCP changes your Azure or Microsoft 365 environment.

The endpoint

https://paa.crimsonowl.eu/mcp/<your-tenant-id>

Replace <your-tenant-id> with your PAA workspace ID. Access is always scoped to that workspace and validated against your membership on every call — you can only ever reach data for a tenant you belong to.

Connecting

There are two ways in. Most people should use OAuth; use a token for automation or a client that doesn’t support OAuth.

Option 1 — Sign in with your Microsoft account (recommended)

For clients that support MCP’s OAuth flow (such as Claude Code), you never paste a token. You add the server URL, the client opens your browser, you sign in with your normal Microsoft account and approve — done. The client handles the rest and refreshes access on its own.

In Claude Code, for example:

claude mcp add --transport http paa "https://paa.crimsonowl.eu/mcp/<your-tenant-id>"

Then run /mcp, choose paa, and Authenticate — a browser window opens for the Microsoft sign-in and consent, and the client connects.

Option 2 — Personal access token

For CI pipelines, automation, or a client without OAuth support, generate a token:

  1. In PAA, go to Settings → MCP Access and Generate token. Copy it — it’s shown once.
  2. Add it to your client as an Authorization: Bearer <token> header on the endpoint above.

Tokens are user-scoped, long-lived, and revocable at any time from the same Settings → MCP Access page — revoke one and it stops working on the next call.

Access requirements

  • An active PAA subscription (Pro or Day Pass) — the same entitlement check runs on every MCP call as everywhere else in the platform.
  • Tenant membership — you must be a member of the workspace in the URL. Filing a control-exception request needs a Member role or above.
  • Authentication — your existing Microsoft (Entra ID) identity, via OAuth or a token you generate. There’s nothing new to register in your Entra tenant.

Good to know

  • Tenant-isolated — the workspace ID in the URL is untrusted input and is membership-checked server-side; there is no way to reach another tenant’s data by changing it.
  • Approval stays with a human — an AI client can propose a risk acceptance, but it can’t approve, reject, or revoke one. That authority stays in the PAA UI with a named approver.
  • No new access to your cloud — MCP reads from the data PAA has already collected under its existing read-only connection. It doesn’t touch your Azure or Microsoft 365 environment.

See Getting Started if you haven’t connected a tenant yet, or contact us if you’d like a walkthrough.