third party risk

Nobody broke into the CRM. An integration that customers had approved years ago simply asked for the data, with valid tokens. The scored answer treats third-party grants as identities you own.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

A vendor breach becomes yours through the access you gave them. The scored answer inventories that access, rotates and revokes it, looks for misuse, and works out what data was exposed.