👤

The User

A CISO at a 3,000-person company exploring attack surface management solutions through their preferred AI assistant.

⬡

The AI Agent

ChatGPT, Gemini, Claude, or any LLM that discovers vendor capabilities via the standard MCP protocol.

◈

The Vendor

Acme Corp with an MCP-enabled endpoint — exposing verified responses and qualification questions.

👤

User

CISO

⬡

AI Agent

LLM Assistant

◈

Acme

MCP Endpoint

1 "I'm looking for an attack surface management solution. Will Acme work for a company our size?"

2 Discovering Acme capabilities...
GET /.well-known/mcp MCP Discovery

3 Returns capability manifest: verified responses for pricing, compliance, integrations. Available actions: schedule_demo, request_quote. Capability Manifest

4 Querying: "Is Acme a good fit for enterprise?" Knowledge Query

5 Qualification needed. Returns structured questions: company size, security requirements, primary use case, required integrations. Qualification Request

6 "To give you a personalized assessment, Acme needs a few details: How many employees? Any specific compliance requirements? What's your primary use case?"

7 "About 3,000 employees, we need SOC2 compliance, and we're focused on external attack surface discovery."

8 Transmits structured qualification data to Acme endpoint. Structured Data

9 92% fit score. SOC2 Type II certified ✓, Enterprise tier supports 10,000+ employees ✓, External ASM included ✓. Estimated: $3,200/mo. Fit Assessment

10 "Great news — Acme is a strong fit for your needs. They're SOC2 certified, support companies your size, and include external attack surface discovery. Estimated cost is around $3,200/month. Want me to schedule a demo?"

01 Zero Integration Required

The AI agent discovers vendor capabilities through a standard protocol. No custom integrations, no API keys, no vendor-specific code.

Standard /.well-known/mcp discovery
Works with any MCP-compatible AI
Vendor controls their own endpoint

02 Vendor-Controlled Qualification

The vendor defines what questions to ask — the AI just mediates the conversation naturally. No rigid forms, no friction.

Dynamic qualification logic
Conversational data collection
Structured responses for processing

03 Verified, Real-Time Data

Every response comes directly from the vendor's authoritative source — not scraped, cached, or hallucinated.

First-party verified information
Real-time pricing and availability
Cryptographic verification optional

04 Actions, Not Just Answers

After qualification, the user can take action immediately — schedule demos, request quotes, open tickets — all through the AI.

Pre-defined action catalog
Authorization controls
Seamless task completion