Cork MCP server

Cork MCP Server

MCP server for Cork's cyber-insurance API for MSPs - clients and their warranty/coverage status, Cork Cyber Score history, risk & compliance events, software vulnerabilities (CVE/CVSS/EPSS/KEV), connected integrations, invoices, distributor partners, and software-installer metadata - for AI assistants and the WYRE Conduit gateway.

Authentication

Cork authenticates with a static Bearer API key, generated in Cork's Admin UI (Settings -> API). Cork's OpenAPI spec also documents an OAuth2 flow for their own remote MCP server, but the underlying credential is the same API key - this connector never performs an OAuth dance, it only ever holds a live bearer key, sent as Authorization: Bearer to Cork's API. In gateway mode the key arrives per-request via the X-Cork-Api-Key header; in local/stdio mode it's read once from CORKAPIKEY.

Configuration

Tools

Clients

• corkgetclients - list clients with warranty status, integration tenants, and recent Cork Cyber Scores.
• corkgetclient_devices - list devices observed for a client across all connected integrations.
• corkgetclient_domains - list email domains observed for a client.
• corkgetclient_inboxes - list email inboxes observed for a client.
• corkgetclientscorehistory - list a client's full Cork Cyber Score history, newest first.

Risk & Compliance

• corkgetcompliance_events - list policy violations and risk events detected for a client's assets.
• corkgetcompliancenotificationsettings - list notification/alerting rules for compliance events.
• corkgetcomplianceeventtypes - list all compliance event types with descriptions and cure periods.
• corkgetsoftware_vulnerabilities - list individual CVEs with CVSS/EPSS/KEV details.
• corkgetsoftwarevulnerabilitysummary - get a rollup of CVEs grouped by software product.

Integrations - read-only subset

• corkgetavailable_integrations - list integration types that can be connected to Cork.
• corkgetconnected_integrations - list integrations connected to Cork.
• corkgetintegration_devices - list devices observed from an integration.
• corkgetintegration_tenants - list customer tenants observed from an integration.
• corkgetintegration_users - list users observed from an integration.

Warranty

• corkgetwarranties - list active cyber warranty packages.

Invoice

• corkgetinvoices - list billing invoices.
• corkgetinvoicelineitems - list billed line items for an invoice.

Distributor - read-only subset

• corkgetpartners - list partner sub-accounts managed by this distributor.

Software Installer - read-only subset

• corkgetinstaller_history - list past software install attempts.
• corkgetsoftware_packages - list software packages available to install.
• corkgetinstaller_setup - get one-time RMM setup instructions for software installs.

Who

• corkwhoam_i - get information on the authenticated user.

Scope

This is a deliberately narrow, read-only, non-credential-exposing v1 surface, hard-scoped to exactly 23 of Cork's 31 operations (29 documented paths). Every tool is classified isAdmin: true in the Conduit gateway given the sensitivity of insurance/risk/compliance data. Roughly a third of Cork's full API is write- or secret-exposing; none of it is implemented here, by design, not by oversight:

Shortened. The full README is on GitHub.