RiskRover MCP for VS Code

Use AI agents in VS Code to:

• draft and review a business-readable Product Breakdown Structure (PBS) for a RiskRover project;
• compare the automated tests in your open workspace folders with the project's Product Risk Analysis (PRA).

The extension bundles the local MCP server, so this setup does not require a separate Node.js installation. A RiskRover API token is required.

GitHub Copilot Chat setup

Use these steps for GitHub Copilot Chat in VS Code, regardless of whether you select Claude, GPT, or another supported model:

1. Install this extension.
2. In RiskRover, open Manage workspace > Configuration > API TOKENS and create your own token.
3. Optional: set riskroverMcp.projectId in VS Code settings if you usually work with one project.
4. Run RiskRover MCP: Set API Token from the Command Palette and paste the token without quotes.
5. Wait for the verification result. An invalid token is not saved. If the token is valid but the default project is unavailable, the token is saved and the project problem is shown separately.
6. Run RiskRover MCP: Test Connection.
7. Run MCP: List Servers, select RiskRover MCP, and start or restart it if needed.
8. Open a new Copilot Chat in Agent mode so the new session receives the RiskRover tools.

MCP: Browse MCP Servers opens the server gallery. It is not the list of configured or running servers, so use MCP: List Servers for connection checks.

Each person should create and store their own RiskRover token. Being a member of somebody else's billing account does not make the account owner's token available in VS Code. For Copilot Business or Enterprise users, an administrator must also allow MCP servers in the applicable GitHub policy.

OpenAI Codex extension setup

Codex is a separate MCP host. It does not read the RiskRover token from VS Code SecretStorage and does not automatically reuse the server registered for Copilot.

1. Install this RiskRover extension.
2. Run RiskRover MCP: Copy Codex Configuration.
3. Open your private user file ~/.codex/config.toml.
4. Remove any older [mcp_servers.riskrover] block, then paste the copied block.
5. Replace PASTE_YOUR_PERSONAL_RISKROVER_API_TOKEN_HERE with your own token. Keep the quotes and never commit this user file.
6. Restart the Codex extension from its MCP server settings, or reload VS Code.
7. Start a new Codex chat and confirm that riskrover is connected in the Codex MCP server list.

The copied configuration uses a stable bundled server path, a 60-second startup timeout, and the operating-system certificate store when the VS Code runtime supports it. Keep the RiskRover extension installed; an extension update refreshes the stable bundled copy.

If you prefer the portable npm package, have Node.js 20 or newer installed and use this private Codex configuration instead:

[mcp_servers.riskrover]
command = "npx"
args = ["-y", "riskrover-mcp-server@latest"]
startup_timeout_sec = 60

[mcp_servers.riskrover.env]
RISKROVER_API_TOKEN = "PASTE_YOUR_PERSONAL_RISKROVER_API_TOKEN_HERE"
RISKROVER_PROJECT_ID = "12345"

Do not configure both the bundled path and the npm path under different names, because that exposes duplicate RiskRover tools.

Ask in normal language

For the test assessment:

Use RiskRover MCP to assess the automated tests in the open workspace folders
against RiskRover project 12345. Keep it read-only and state the folders and
limitations included in the assessment.

For the product breakdown:

Use RiskRover MCP to draft a complete business-readable PBS for RiskRover
project 12345. Present it for review and do not import it yet.

Draft and review RiskRover updates

RiskRover MCP can also help you:

• update PRA likelihood and impact;
• update test intensity and custom strategy text, and select or remove test techniques;
• update effort-estimation baseline hours, size, and complexity;
• create or update project roles and hourly rates;
• update activity and role allocations for each test level;
• assign or remove qualities for individual level-3 PBS Components or clearly identified groups.

For page updates:

Use RiskRover MCP to review the PRA, Test Strategy, Effort Estimation, roles,
and resource allocations for project 12345. Draft the requested changes,
validate all values, show every proposed change, and do not submit anything
until I explicitly approve it.

For PBS Component quality assignments:

Use RiskRover MCP to review the current PBS quality assignments for project
12345. Add Security to every Component under Commerce > Checkout while
preserving its other qualities. Show every exact addition and removal and do
not submit anything until I explicitly approve it.

Removing an assigned quality also deletes its stored PRA, strategy, estimation, and dependent-link data. All writes require a read-and-write token, explicit review, and manual verification in RiskRover.

Large PBS and PRA contexts are read in bounded continuation pages. Approved updates re-check only the selected Components or rows before writing.

Repository and workspace scope

RiskRover project access depends on the token and project ID, not on the name or layout of the repository currently open in VS Code. A full application repository, a separate automation repository, and a test-only repository are all valid scopes.

The AI agent can assess only the workspace folders you deliberately opened. If relevant source or tests live elsewhere, use File > Add Folder to Workspace... to create a multi-root workspace, then start a new assessment. The agent should state which roots it inspected and identify missing roots as a limitation; it should not inspect unrelated directories implicitly.

The MCP server itself never reads repository files or runs commands. Workspace inspection is performed by the selected AI client using that client's permissions.

Authentication results

• Connection succeeded: the token was accepted; a configured default project was also checked when present.
• HTTP 401: the token is invalid, expired, or revoked. Create or copy a current personal token and run Set API Token again.
• HTTP 403: the token is valid, but its scope or the user's project membership is insufficient.
• HTTP 404: check the project ID and whether that user can see the project.
• Service unreachable or certificate error: the extension can optionally save without verification; run Test Connection when connectivity is restored and check corporate proxy/firewall rules.

A server shown as Running has completed MCP startup. Use Test Connection to prove RiskRover authentication independently of tool discovery.

Commands

Data and write permissions

• Read-only token scope is enough for PRA assessment and PBS drafting.
• Read-and-write scope is required to import a reviewed PBS, submit reviewed page updates, or change Component quality assignments.
• All RiskRover write tools require explicit review; PBS replace mode needs additional confirmation.
• Repository content is not sent to RiskRover. The selected AI provider may receive RiskRover data and workspace excerpts according to that client's data controls.
• The extension has no telemetry of its own and does not persist PRA or repository content.

Support: contact@riskrover.io