open-source-compliance

Open-source compliance with Probo

Use the Probo MCP server bundled with this plugin to read and write GRC data. Do not guess entity IDs or organization scope — discover them with MCP tools first.

Before you start

1. Confirm the Probo MCP server is connected. If not, ask the user to run /mcp or claude mcp login probo to complete the OAuth 2.0 sign-in.
2. Identify the target organization. List organizations if the user did not provide one.
3. Prefer MCP tools over manual API calls. The Probo MCP API mirrors the platform's GraphQL surface.

Common workflows

Vendor / third-party review

1. List or search third parties for the organization.
2. Pull existing risk assessments and contacts.
3. Record findings and update assessment status through MCP mutations.
4. Summarize residual risk and recommended follow-ups for the user.

Control and obligation tracking

1. List controls, measures, or obligations relevant to the user's question.
2. Link evidence (documents, audits) where appropriate.
3. Report gaps between required and implemented controls.

Evidence and documentation

1. Locate the relevant document or audit in Probo.
2. Fetch version history or published versions as needed.
3. Draft updates; use MCP upload tools when the user asks to attach files.

Output expectations

• Cite Probo entity IDs (GIDs) for anything you create or update.
• Separate facts pulled from Probo from your analysis.
• Flag missing data instead of inventing compliance status.
• Keep recommendations actionable and mapped to Probo entities where possible.

References

See references/workflows.md for extended workflow notes.