👤

The User

A CISO at a 3,000-person company exploring attack surface management solutions through their preferred AI assistant.

⬡

The AI Agent

ChatGPT, Gemini, Claude, or any LLM that discovers vendor capabilities via the standard MCP protocol.

◈

The Vendor

Acme Corp with an MCP-enabled endpoint — exposing verified responses and qualification questions.

👤

User

CISO

⬡

AI Agent

LLM Assistant

◈

Acme

MCP Endpoint

1 "I'm looking for an attack surface management solution. Will Acme work for a company our size?"

2 Connecting to Acme MCP server...
POST /mcp → initialize MCP Initialize

3 Server responds with capabilities. Tools: ask_question, schedule_demo, request_quote, qualify. MCP Capabilities

4 tools/call → ask_question: "Is Acme a good fit for us?" tools/call

5 Qualification needed. Returns qualificationRequired flag. Remaining fields: company size, security requirements, primary use case, required integrations. structuredContent

6 "To give you a personalized assessment, Acme needs a few details: How many employees? Any specific compliance requirements? What's your primary use case?"

7 "About 3,000 employees, we need SOC2 compliance, and we're focused on external attack surface discovery."

8 tools/call → qualify with structured data tools/call

9 92% fit score. SOC2 Type II certified ✓, Enterprise tier supports 10,000+ employees ✓, External ASM included ✓. Estimated: $3,200/mo. structuredContent

10 "Great news — Acme is a strong fit for your needs. They're SOC2 certified, support companies your size, and include external attack surface discovery. Estimated cost is around $3,200/month. Want me to schedule a demo?"

01 Zero Integration Required

The AI agent discovers vendor capabilities through a standard protocol. No custom integrations, no API keys, no vendor-specific code.

Standard MCP initialize handshake
Works with any MCP-compatible AI
Vendor controls their own endpoint

02 Vendor-Controlled Qualification

The vendor defines what questions to ask — the AI just mediates the conversation naturally. No rigid forms, no friction.

Dynamic qualification logic
Conversational data collection
Structured responses for processing

03 Verified, Real-Time Data

Every response comes directly from the vendor's authoritative source — not scraped, cached, or hallucinated.

First-party verified information
Real-time pricing and availability
Cryptographic verification optional

04 Actions, Not Just Answers

After qualification, the user can take action immediately — schedule demos, request quotes, open tickets — all through the AI.

Pre-defined action catalog
Authorization controls
Seamless task completion