RiskRover MCP

Give an MCP-capable AI agent the RiskRover Product Risk Analysis (PRA), assessment policy, and project context it needs to assess automated-test evidence in your VS Code workspace. RiskRover MCP can also draft, validate, and optionally import a reviewed Product Breakdown Structure (PBS).

A RiskRover API token is required. Creating API tokens is available on eligible RiskRover plans and depends on account permissions. Read-only scope is enough for assessment and PBS drafting; importing a reviewed PBS requires read-and-write scope.

Quick start in VS Code

1. Install this extension and open the repository you want the agent to inspect.

2. In RiskRover, open User menu > Settings > API Tokens and create a token.

3. Optionally set a default project in VS Code settings:

   {
     "riskroverMcp.projectId": 12345
   }
   

4. Run RiskRover MCP: Set API Token from the Command Palette.

5. Run MCP: List Servers and confirm that RiskRover MCP is enabled and running.

6. Start a new agent session, then ask:

   Use RiskRover MCP to assess automated test coverage in this workspace against
   the configured project's PRA. Keep the assessment read-only: do not run
   commands or tests, and do not modify files.
   

Without a default project, include it naturally: Use RiskRover MCP to assess this workspace against RiskRover project 12345.

You do not need to call an API or name an internal MCP tool. The agent selects the appropriate RiskRover capability.

Authentication and model choice

The extension stores the API token in VS Code SecretStorage and only registers its bundled local server after a nonblank token exists. It never opens an authentication prompt while an Agent Host is resolving the server.

MCP registration and authentication belong to the client/Agent Host, not to the selected language model. Changing between supported Claude, Codex, GPT, or other models does not require a different RiskRover token or server definition.

The server connects to https://app.riskrover.io. A Running status means the MCP process initialized; the first RiskRover data request validates the token. Authentication failures distinguish an invalid token (401), insufficient permission (403), and an inaccessible project or resource (404).

Other MCP clients

RiskRover also publishes a client-neutral stdio package. A client that uses the common mcpServers format can launch it with:

{
  "mcpServers": {
    "riskrover": {
      "command": "npx",
      "args": ["-y", "riskrover-mcp-server@latest"],
      "env": {
        "RISKROVER_API_TOKEN": "${RISKROVER_API_TOKEN}",
        "RISKROVER_PROJECT_ID": "12345"
      }
    }
  }
}

See the complete setup guide for VS Code file configuration, GitHub Copilot Agent Host and CLI, Claude Code/Desktop, Cursor, Codex CLI/IDE/ChatGPT desktop, native Windows, and generic MCP clients.

For Codex, run RiskRover MCP: Copy Codex Configuration to copy a safe config.toml entry that launches the public package and forwards RISKROVER_API_TOKEN from the environment. The command never copies the token.

What it provides

PRA-guided automated-test assessment

• Fetches and normalizes the latest PRA into independently traceable assessment units.
• Supplies RiskRover assessment policy version 1.0.0, warnings, and deterministic provenance.
• Lets the selected agent inspect static workspace evidence with its own read-only capabilities.
• Reports defined coverage separately from execution status and prioritizes Risk A, B, then C findings.
• Requires evidence to reference real workspace paths, tests, assertions, configuration, or existing reports.

The MCP server itself does not inspect the workspace, execute commands or tests, change files, or submit assessment results.

PBS drafting and reviewed import

• Retrieves project context and ordered test levels.
• Helps the agent draft complete, business-readable System > Feature > Component trees.
• Validates tree depth, wording, duplicates, suspicious uniformity, and completeness.
• Imports only a specifically reviewed PBS after an explicit user request. Append is the default mode.

Data and permissions

• RiskRover MCP retrieves RiskRover project data over HTTPS.
• The selected AI client or model provider may receive RiskRover data and workspace excerpts selected by that client.
• Repository content is not sent to RiskRover by this extension.
• RiskRover MCP has no telemetry of its own and does not persist PRA or repository content.
• The bundled server has no repository read/write or command-execution tools.
• PBS submission is the only RiskRover write operation and requires explicit review.

Commands

Troubleshooting

• Use MCP: List Servers to inspect configured servers, start/restart RiskRover, and open its output.
• MCP: Browse MCP Servers opens the server gallery; it is not the runtime status list.
• Start a new agent session after setting the token or changing the project, because an existing session can retain its original tool list.
• If tools remain stale, run MCP: Reset Cached Tools, RiskRover MCP: Refresh Server Registration, or Developer: Reload Window.
• Organizational MCP policy can prevent any local server from loading, regardless of model.

Support: contact@riskrover.io