Skip to main content

Connect an AI assistant

Connect an AI assistant like Claude, ChatGPT, Gemini, or Cursor to ask about your organization's devices: their check results, which ones meet your policy, and which devices run an outdated OS or browser or have known vulnerabilities. XFA's main value is Verify device security at sign-in: XFA checks every device at sign-in and warns people first, and people install the XFA app themselves when prompted and fix issues themselves, with a Fix button where XFA offers one. XFA can also Discover all devices. The assistant connects over the Model Context Protocol (MCP), an open standard for letting an assistant read from an external data source through a connector. XFA runs an MCP server: you sign in to XFA once, approve one organization, and from then on the assistant reads that organization's data on your behalf.

Access is read-only. The assistant can look at your data, but it cannot change a device, a policy, or a decision.

Beta

The AI assistant connection is in beta and is rolled out per organization. What it can read may still change, and it is not yet available to everyone.

Set it up for your assistant

The connection works the same way everywhere: you add XFA's MCP server URL as a connector, then sign in to XFA and approve one organization. Only the menu names differ per assistant, so pick yours:

You will need the MCP server URL from the XFA dashboard (Integrations → Connect an AI assistant). It looks like https://mcp.xfa.tech/mcp.

Using VS Code, Windsurf, Zed, or another MCP client? Point it at that same URL. The xfa-mcp connector package has per-client configs and one-click installs.

What your assistant can access

Once connected, the assistant can read, for the one organization you approve:

  • Your organization's details, its policies, and who the signed-in user is.
  • The devices in your organization and each device's security posture: the checks XFA has evaluated, whether a device is verified (checked directly by XFA, usually through the XFA app) or only discovered through your identity provider, and whether it meets its policy (is compliant). Details of discovered devices are available where your plan includes them.
  • An overview of how your organization is doing: how many devices are verified and compliant, how many users still have no verified device, exposure to known vulnerabilities, and a few figures over time: disk encryption, screen lock, and how far behind OS and browsers are.
  • XFA's software version and CVE catalog, to reason about whether a given software version is current or affected by a known vulnerability.

It cannot see other organizations or take any action.

Examples of what you can ask

  • "How many of our devices are still unverified, and how many are compliant with our default policy?"
  • "Which devices fail a check right now?"
  • "Which devices are out of date or missing disk encryption?"
  • "Show me a specific user's devices and whether they're compliant."
  • "How many devices are exposed to ransomware, phishing, or data-breach vulnerabilities?"
  • "Is disk encryption improving over the last three months?"
  • "What policies do we have, and which one is the default?"

The assistant answers from the current data in XFA and can summarize or interpret what it finds. It changes nothing itself. People fix their own devices: they click Fix and approve the suggested fix where XFA offers one, or follow a step by step guide, and XFA checks again.

Manage or revoke access

  • Open Connected apps in the XFA dashboard to see which assistants have access and to which organization.
  • Revoke a connection there at any time. The assistant can no longer obtain access, and it would have to be approved again to reconnect.

How access works

The connection uses OAuth 2.1: your assistant never sees your XFA password, and the token XFA issues is scoped to the one organization you approved and to reading only. If your organization requires multi-factor authentication, you complete it during sign-in, the same as any other XFA login, before the connection is granted.

  • Devices overview: where the device, posture, and verification data the assistant reads comes from.
  • Policies: how a device is judged compliant.