---
description: "Work with Probo SOC-2 compliance platform via MCP tools. Manage risks, documents (policies), controls, vendors, and evidence."
---

# Probo SOC-2 Compliance Skill

## Configuration

Configure in your project:
- **API Token**: Set `PROBO_API_TOKEN` in `.env`
- **MCP Server**: Add `probo` to `.mcp.json` (see https://www.getprobo.com/docs/api/mcp/overview)
- **Org ID**: Set your organization ID below or in environment

---

## MCP Tools Reference

### Organizations
| Tool | Description |
|------|-------------|
| `mcp__probo__listOrganizations` | List all orgs you have access to |

### Documents (Policies)
| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `mcp__probo__listDocuments` | List all documents/policies | `organizationId` |
| `mcp__probo__getDocument` | Get document details | `organizationId`, `documentId` |
| `mcp__probo__addDocument` | Create new document | `organizationId`, `name`, `content` |
| `mcp__probo__deleteDocument` | Delete document | `organizationId`, `documentId` |
| `mcp__probo__listDocumentVersions` | List document versions | `organizationId`, `documentId` |
| `mcp__probo__getDocumentVersion` | Get specific version | `organizationId`, `documentId`, `versionId` |
| `mcp__probo__createDraftDocumentVersion` | Create draft version | `organizationId`, `documentId`, `content` |

### People
| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `mcp__probo__listPeople` | List people in org | `organizationId` |

### Frameworks & Controls
| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `mcp__probo__listFrameworks` | List frameworks (SOC 2, etc.) | `organizationId` |
| `mcp__probo__listControls` | List framework controls | `organizationId`, `frameworkId` |
| `mcp__probo__getControl` | Get control details | `organizationId`, `controlId` |
| `mcp__probo__updateControl` | Update control | `organizationId`, `controlId` |
| `mcp__probo__linkControlDocument` | Link control to document | `organizationId`, `controlId`, `documentId` |

### Risks
| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `mcp__probo__listRisks` | List all risks | `organizationId` |

### Vendors
| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `mcp__probo__listVendors` | List all vendors | `organizationId` |

### Measures & Tasks
| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `mcp__probo__getMeasure` | Get measure details | `organizationId`, `measureId` |
| `mcp__probo__listTasks` | List tasks | `organizationId` |

---

## Usage Examples

Just ask naturally - the MCP tools will be used automatically:

```
"List all documents in Probo"
-> Uses mcp__probo__listDocuments

"Show me the risks"
-> Uses mcp__probo__listRisks

"What controls are in our SOC 2 framework?"
-> Uses mcp__probo__listFrameworks then mcp__probo__listControls

"Link control CC1.1 to the Information Security Policy"
-> Uses mcp__probo__linkControlDocument
```

---

## Quick Reference

### Risk Treatment Values
| Value | Description |
|-------|-------------|
| `MITIGATED` | Controls reduce the risk |
| `ACCEPTED` | Risk accepted as-is |
| `AVOIDED` | Activity eliminated |
| `TRANSFERRED` | Risk shifted (insurance) |

### Risk Severity (Likelihood x Impact)
| Score | Level |
|-------|-------|
| >=20 | Catastrophic |
| 12-19 | Critical |
| 5-11 | Marginal |
| 1-4 | Negligible |

### Document/Policy Status
| Status | Description |
|--------|-------------|
| `DRAFT` | In development |
| `APPROVED` | Active policy |
| `DEPRECATED` | Retired |

---

## Fallback: Direct GraphQL

For operations not covered by MCP tools, use the GraphQL API:

```bash
# SAFETY: Ensure variables are properly escaped to prevent JSON injection.
# Never interpolate unsanitized user input directly into the query string.
probo_query() {
  curl -s -X POST "${PROBO_API_URL:-https://app.getprobo.com}/api/console/v1/query" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $PROBO_API_TOKEN" \
    -d "{\"query\": \"$1\"}" | jq .
}
```

### Create Risk
```graphql
mutation { createRisk(input: {
  organizationId: "$ORG_ID"
  name: "Risk Name"
  description: "Description"
  treatment: MITIGATED
  inherentLikelihood: 3
  inherentImpact: 4
}) { risk { id } }}
```

### Create Vendor
```graphql
mutation { createVendor(input: {
  organizationId: "$ORG_ID"
  name: "Vendor Name"
  description: "What they provide"
  serviceCriticality: HIGH
  riskTier: TIER_2
}) { vendorEdge { node { id } } }}
```

### Batch Create Risks
```graphql
mutation CreateMultipleRisks {
  risk1: createRisk(input: {
    organizationId: "$ORG_ID"
    name: "Data Breach Risk"
    description: "Unauthorized access to customer PII"
    treatment: MITIGATED
    inherentLikelihood: 4
    inherentImpact: 5
    residualLikelihood: 2
    residualImpact: 3
  }) { risk { id name } }

  risk2: createRisk(input: {
    organizationId: "$ORG_ID"
    name: "Vendor Dependency Risk"
    description: "Critical service unavailable due to vendor outage"
    treatment: MITIGATED
    inherentLikelihood: 3
    inherentImpact: 4
    residualLikelihood: 2
    residualImpact: 2
  }) { risk { id name } }
}
```

### Batch Create Vendors
```graphql
mutation CreateVendors {
  vendor1: createVendor(input: {
    organizationId: "$ORG_ID"
    name: "Amazon Web Services"
    description: "Cloud infrastructure"
    serviceCriticality: CRITICAL
    riskTier: TIER_1
  }) { vendorEdge { node { id } } }

  vendor2: createVendor(input: {
    organizationId: "$ORG_ID"
    name: "Stripe"
    description: "Payment processing"
    serviceCriticality: CRITICAL
    riskTier: TIER_1
  }) { vendorEdge { node { id } } }
}
```

### Gap Analysis: Controls Without Documents
```graphql
query ControlsWithoutDocuments {
  node(id: "$ORG_ID") {
    ... on Organization {
      frameworks(first: 10) {
        edges {
          node {
            name
            controls(first: 200) {
              edges {
                node {
                  referenceID
                  name
                  policies { totalCount }
                  mesures { totalCount }
                }
              }
            }
          }
        }
      }
    }
  }
}
```
Filter results where `policies.totalCount == 0` to find controls with no linked documents.

### Update Risk Assessment
```graphql
mutation UpdateRisk {
  updateRisk(input: {
    id: "RISK_ID"
    residualLikelihood: 1
    residualImpact: 2
    treatment: MITIGATED
  }) { risk { id residualLikelihood residualImpact } }
}
```

### Export Data
```bash
# Export risks
probo_query 'query { node(id: "$ORG_ID") { ... on Organization { risks(first: 100) { edges { node { id name treatment } } } } } }'

# Export vendors
probo_query 'query { node(id: "$ORG_ID") { ... on Organization { vendors(first: 50) { edges { node { id name riskTier } } } } } }'

# Count summary
probo_query 'query { node(id: "$ORG_ID") { ... on Organization { risks(first:1){totalCount} policies(first:1){totalCount} vendors(first:1){totalCount} } } }'
```

---

## Troubleshooting

| Issue | Solution |
|-------|----------|
| MCP tools not found | Restart Claude Code, check `.mcp.json` |
| 401 Unauthorized | Verify `PROBO_API_TOKEN` in `.env` |
| Tool fails | Try GraphQL fallback |

---

## Resources

- **Probo**: https://www.getprobo.com
- **MCP Docs**: https://www.getprobo.com/docs/api/mcp/overview