cyberday-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@cyberday-mcpshow me the details of system 7796087"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Cyberday MCP Server
An MCP (Model Context Protocol) server for the Cyberday.ai API. Enables AI agents (e.g. Claude Code, Claude Desktop) to read and manage your organization's data systems registry in Cyberday.
Features
Tool | Description |
| List data systems with pagination (default 20 per page) |
| Search/filter systems by name, status, framework, or assigned user |
| Get full details of a specific system by ID |
| Create a new data system |
| Create or update a system with extended fields (owner, admin, cost, processors, etc.) |
| Overview statistics: counts, status breakdown, hosting types, review status, framework coverage |
Response formatting
Compact list view —
list_systemsandsearch_systemsreturn only key fields (name, status, owner, hosting, etc.)Full details —
get_systemreturns all fields with human-readable names (e.g.hosting_type,authentication_methods)Empty fields removed automatically from all responses
HTML tags stripped from text fields
Pagination —
limitandoffsetparameters on list/search tools
Related MCP server: VAST DB MCP Server
Prerequisites
Node.js 18+
A Cyberday API key (requires admin access to generate)
Installation
git clone https://github.com/telepist/cyberday-mcp.git
cd cyberday-mcp
npm install
npm run buildGetting your API key
Log in to Cyberday
Go to Settings > Integration settings
Enable API Access
Copy the API key
Usage with Claude Code
Register the MCP server:
claude mcp add --transport stdio cyberday \
-e CYBERDAY_API_KEY=your-api-key-here \
-- node /path/to/cyberday-mcp/dist/index.jsRestart Claude Code. Then you can ask things like:
"List our data systems"
"Which systems are hosted outside EU?"
"Show me the details of system 7796087"
"Give me a summary of our system registry status"
"Search for systems assigned to john@example.com"
"Create a new system called 'Salesforce CRM'"
Usage with Claude Desktop
Add to your Claude Desktop config (claude_desktop_config.json):
{
"mcpServers": {
"cyberday": {
"command": "node",
"args": ["/path/to/cyberday-mcp/dist/index.js"],
"env": {
"CYBERDAY_API_KEY": "your-api-key-here"
}
}
}
}Development
npm run dev # TypeScript watch mode
npm run build # Build for production
npm start # Start the serverAPI limitations
The Cyberday public API currently supports data systems management only. Tasks, policies, frameworks, risks, and reports are not yet available via the API. The server is structured so that new endpoints can be easily added to src/index.ts as Cyberday expands its API.
Rate limit: 100 requests / 60 seconds.
License
Available Tools
6 toolscreate_systemA
Create a new data system in Cyberday with a given title. Returns the created system details. For adding extended details (owner, hosting, processors, etc.), use 'create_system_advanced'.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Name/title of the new data system |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose that the call returns the created system details and that the operation creates a new entity, but it omits permissions/authentication requirements, error or duplicate-title behavior, and whether the system is created in a draft or active state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with zero filler: what it does, what it returns, and where to go for more. The scope statement and the alternative routing are both front-loaded and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter create tool with no annotations and no output schema, the description covers purpose, return value, and sibling routing adequately. It stops short of behavioral caveats (auth, validation, side effects) that would make it fully self-sufficient without annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter exists and schema description coverage is 100%, so the schema fully documents 'title'. The description's phrase 'with a given title' adds no format, constraint, or uniqueness semantics beyond the schema, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a new data system') and immediately distinguishes itself from the sibling 'create_system_advanced' by scope of details. An agent can tell this apart from the other create/list/get siblings without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative ('create_system_advanced') and the condition that selects it ('For adding extended details (owner, hosting, processors, etc.)'). It lacks an explicit inverse statement of when this basic variant is preferred, but the routing intent is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_system_advancedB
Create or update a data system in Cyberday with extended details. If a system with the given title already exists, it will be updated with the provided fields. Fields not provided will remain unchanged for existing systems.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Name/title of the data system (used as identifier for matching existing systems) | |
| purpose | No | Purpose of data processing in this system | |
| processors | No | External data processor names (e.g. vendor companies) | |
| linked_systems | No | Names of other systems this system integrates with | |
| additional_cost | No | Cost information (e.g. '500€/month', 'Free tier') | |
| additional_name | No | Additional/alternative name for the system | |
| additional_admin | No | System admin / technical contact person | |
| additional_owner | No | System owner (person responsible for the system) | |
| processors_description | No | Description of what processors do with the data |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose meaningful behavior for a mutation tool: upsert-by-title semantics and that unprovided fields remain unchanged on existing systems. It omits permissions/auth requirements, whether it returns the resulting object, and any rate limits or side effects, leaving notable gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the verb and resource, and only three sentences with no filler. The second and third sentences overlap on update behavior and could be merged, but nothing is wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a nine-parameter mutation tool with no annotations and no output schema, the description covers the key upsert/merge semantics but says nothing about return values, required permissions, or differentiation from the sibling create_system. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all nine parameters are already documented in the schema. The description's note about title being the matching identifier duplicates the schema's own wording and adds no new syntax or format meaning beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (create or update a data system) and qualifies it with 'extended details', making the tool's scope clear. However, it never explicitly distinguishes itself from the sibling create_system or explains what 'extended' means relative to it, so an agent must infer the difference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains matching behavior ('If a system with the given title already exists, it will be updated') but gives no guidance on when to choose this tool over the sibling create_system or update paths. Choosing between the advanced and basic create variants is left entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_systemA
Get full details of a specific data system by its ID. Returns all available fields with human-readable names, including purpose, hosting, processors, access controls, integrations, etc. Empty fields are omitted from the response. Use 'list_systems' or 'search_systems' first to find system IDs.
| Name | Required | Description | Default |
|---|---|---|---|
| system_id | Yes | The unique ID of the system to retrieve |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden, and it delivers useful behavioral detail: it returns all available fields with human-readable names and omits empty fields. What it omits is failure behavior (e.g., what happens for an unknown ID) and any permission requirements, so it is strong but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences with zero filler: identity/purpose first, then return shape, then the routing hint. Each sentence contributes distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, so the description must stand in for both, and it does so by describing the returned fields and the empty-field omission rule. It stops short of covering error/not-found behavior or authorization needs, which is the only meaningful gap for a single-record read.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter (system_id with its own description), so the schema already documents the input fully. The description's 'by its ID' framing adds no syntax or format detail beyond that, matching the baseline 3 for high-coverage schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get full details of a specific data system by its ID'), and the singular scope plus ID-based lookup distinguishes it from the list/search siblings. An agent can tell immediately this is the single-record fetch rather than a query tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternatives ('list_systems' or 'search_systems') and the condition that selects them ('first to find system IDs'), establishing the correct lookup-then-fetch workflow. Nothing about when to reach for the siblings is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_systemsA
List data systems (tietojärjestelmät) registered in Cyberday. Returns a compact overview of each system with key fields: name, status, owner, hosting, business units, etc. Use 'get_system' with a specific ID to see full details of a single system. Supports pagination with 'limit' and 'offset' parameters.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of systems to return. Defaults to 20. Use 0 for all systems. | |
| offset | No | Number of systems to skip (for pagination). Defaults to 0. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the disclosure burden. It usefully characterizes the result as a 'compact overview' and lists the fields returned, but says nothing about read-only safety, permission requirements, or pagination behavior beyond naming the parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the core action, then the return nature, then the sibling alternative, then pagination. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with no output schema, the description sufficiently covers what is returned and how to drill into a single record. Nothing about response shape or limits is missing, though the absence of annotations leaves behavioral guarantees implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents limit and offset, including the default of 20 and offset semantics. The description adds only a restatement that pagination is supported, which is minimal value over the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('List data systems registered in Cyberday') and immediately differentiates itself from 'get_system' by contrasting compact overview vs. full details. An agent can distinguish this from siblings like search_systems or systems_summary without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use 'get_system' with a specific ID for full detail, giving a clear when-to-use-this-vs-that condition. It does not address when to prefer 'search_systems' or 'systems_summary', so the routing guidance is clear but incomplete across the sibling set.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_systemsA
Search and filter data systems by name, description, status, hosting type, or assigned user. Returns compact results with key fields. Use 'get_system' for full details. All filters are combined with AND logic. Text searches are case-insensitive. Example statuses: 'Käsitelty' (done), 'Aktiivinen' (active), 'Ei käytössä' (not in use).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (default: 20, 0 for all) | |
| query | No | Text to search for in system name or description | |
| status | No | Filter by workflow status (e.g. 'active', 'done', 'Käsitelty', 'Aktiivinen') | |
| framework | No | Filter by associated framework/goal name | |
| assigned_to | No | Filter by assigned user name or email |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses that results are compact, that filters combine with AND, and that text matching is case-insensitive, but it is silent on pagination beyond the raw limit parameter, on permissions/auth needs, and on ordering or total-count behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose and the get_system pointer in the first two sentences, then moves to filter semantics. The trailing list of localized status examples is longer than strictly necessary, but every sentence maps to a real behavioral detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by stating that results are compact with key fields and directing the agent to get_system for full detail. Combined with full schema coverage of all five optional parameters, this is close to complete, with the main remaining gap being result ordering and pagination semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter; the baseline is 3. The description adds genuine semantics that the schema lacks (AND combination across filters, case-insensitive text matching), but also names 'hosting type' as a filter when no such parameter exists, introducing mild noise rather than added clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (search and filter) plus the resource (data systems) and enumerates the filterable fields, which is far more than a restated name. It differentiates from get_system explicitly ('Use get_system for full details'), but does not distinguish itself from sibling list_systems or systems_summary, so an agent cannot fully route between the three list-like tools on the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear context — multi-criteria filtering with AND logic — and names the alternative tool for full-record retrieval. It stops short of stating when to prefer this over list_systems or systems_summary, and gives no guidance on the limit parameter or when to request all results.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
systems_summaryA
Get a high-level overview of all data systems in Cyberday. Returns: total count, status breakdown, systems overdue for review, framework coverage, and CIA importance distribution. This is the best starting point to understand the current state of your data systems.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden and does a fair job: it enumerates what the response contains (total count, status breakdown, overdue reviews, framework coverage, CIA importance distribution), which tells the agent this is a read-only aggregate. It does not explicitly confirm read-only/non-destructive behavior or clarify edge cases like an empty system list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, front-loaded sentences: purpose, return contents, recommended use. Efficient overall, though 'high-level overview' and 'best starting point to understand the current state' are mildly redundant in intent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description appropriately compensates by listing the return fields, and with zero parameters there is nothing else an agent needs to invoke it. A brief note on whether results are scoped to a tenant or affected by filters would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline of 4 applies. The description correctly implies no input is needed, consistent with the empty input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb ('Get') and resource ('all data systems in Cyberday') and frames itself as an aggregate summary rather than a list, which implicitly separates it from list_systems and search_systems. It stops short of naming those siblings explicitly, so the differentiation is inferable rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'This is the best starting point to understand the current state of your data systems' gives a clear positive use case. However, it offers no when-not guidance or explicit routing away from siblings like list_systems or search_systems when the agent needs individual records rather than aggregates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.0- First observed
create_system - First observed
create_system_advanced - First observed
get_system - First observed
list_systems - First observed
search_systems - First observed
systems_summary
TDQS
Scored across 6 tools
Most tools are clearly distinct: list/search/get handle different retrieval needs, and systems_summary provides aggregate analytics. However, create_system and create_system_advanced overlap on creation, which could cause an agent to choose the wrong one when extended fields are needed.
Five tools follow a consistent verb_noun snake_case pattern (list_systems, search_systems, get_system, create_system, create_system_advanced). The outlier systems_summary uses a noun_noun style, but the overall convention remains readable and predictable.
With six tools, the set is well-scoped for a data-system registry MCP. Each tool covers a distinct operation or aggregation need, and the count avoids both excessive fragmentation and under-provisioning.
The surface covers list, search, get, create, update-via-advanced-create, and summary analytics. The main gap is a dedicated delete or archive operation, which is a minor omission for a registry but not a severe workflow blocker.
Maintenance
Related MCP Connectors
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Give AI agents secure access to RevDesk calling, SMS, phone numbers, caller IDs, and usage.
Connect AI agents to Process Street workflows, tasks, runs, data sets, and operational records.
Related MCP Servers
- FlicenseCqualityAmaintenanceEnables AI agents to interact with the ComplianceCow platform to retrieve compliance insights, dashboard data, and auditable evidence through a Compliance Graph. It also supports automated remediation actions such as fixing policies and creating tickets in external tools.10012-
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to securely query VAST Data databases for schema, metadata, and sample data via read-only SQL and MCP resources.MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI systems to manage Verodat accounts, workspaces, and datasets, including creating datasets, querying data, and executing AI-powered queries through natural language.9 npmApache 2.0
- AlicenseNot gradedqualityFmaintenanceProvides AI assistants with read-only access to Secureframe's compliance data, enabling querying of security controls, tests, users, vendors, and more across frameworks like SOC 2 and ISO 27001.8MIT