Skip the install. Get this working in under 2 minutes.
Start a free trial on cloud.anythingmcp.com, add the Archer IRM in one click, then point your AI client (Claude, ChatGPT, Copilot or Cursor) at the generated MCP endpoint. No Docker, no git clone, zero engineering experience required.
Summary
Read Archer IRM (formerly RSA Archer) GRC data through its REST and Content APIs: applications, levels, fields and values lists, plus risk, control, finding and incident records searched with OData. Session login with an Archer account.
Try asking
Example prompts for Archer IRM
Click any prompt to copy it. Paste into Claude, ChatGPT, Cursor, Gemini, Copilot or OpenClaw to run it against this connector.
Claude is AI and can make mistakes. Please double-check responses.
💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Archer IRM, paste your credentials, mint an MCP API key and you're done. No Docker, no
git clone, no local server.
Archer IRM
Read Archer IRM (formerly RSA Archer) GRC data through its REST and Content APIs: applications, levels, fields and values lists, plus risk, control, finding and incident records searched with OData. Session login with an Archer account.
Setup
- Ask your Archer administrator for a dedicated API account that logs in with a password and has read access to the applications the AI should query. Every call runs with that account's permissions.
- Set
ARCHER_URLto the address you open Archer on, withhttps://and without/appsor a trailing slash, for examplehttps://yourcompany.archerirm.comfor Archer SaaS. On-premise installs often live under a virtual directory: include it, as inhttps://archer.example.com/RSAarcher. - Set
ARCHER_INSTANCEto the instance name you enter on the Archer login page (often a number for Archer SaaS). An administrator also finds it in Archer Control Panel or Administration → Installation Settings. - Set
ARCHER_USERNAMEandARCHER_PASSWORD. Fill inARCHER_USER_DOMAINonly if the account belongs to a user domain; leave it empty otherwise. - With single sign-on, an administrator must select Allow manual bypass for the instance in Archer Control Panel, or the REST login is refused.
- Install the connector and run
archer_list_applications. It lists the applications the account can see, such as the risk register, findings, controls, incidents, policies and vendors.
Read-only: this first version only reads. The AI cannot create, change or delete records in Archer.
Sessions: the connector logs in with the account and logs in again on its own when Archer's session timeout (often 20 to 30 minutes) ends the session.
How it finds records: archer_list_content_endpoints shows the levels the account can read, each with its alias, and archer_query_records searches one of them using readable field names, at most 1,000 records per call. Aliases are case-sensitive. archer_list_application_fields and archer_get_values_list turn field and value ids into readable names.
Reports: Archer serves saved reports and statistic searches only through its SOAP web services, which this connector does not call. Ask the AI to rebuild the report as a query with archer_query_records instead.
Common errors: 401 means the login or the session failed, so check the account, the instance name and, with single sign-on, the manual bypass. 403 means the account lacks the permission for that application. An answer with IsSuccessful set to false and validation messages means Archer refused the request.
The connector does not write to Archer, run saved reports or statistic searches, or use Archer's SOAP web services.
Prerequisites: ARCHER_URL, ARCHER_INSTANCE, ARCHER_USERNAME, ARCHER_PASSWORD
Install the connector locally
curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d
Open http://localhost:3000/connectors/store, pick Archer IRM and paste in the env vars listed under Prerequisites.
Available tools
| Tool | What it does |
|---|---|
archer_list_applications | All applications (modules) of the Archer instance with id, name, alias, type, status and GUID |
archer_get_application | One application by id: name, alias, description, type, status, whether it is a sub-form or questionnaire, and its GUID |
archer_list_levels | The levels of an application |
archer_list_level_fields | Field definitions of one level: id, name, alias, type (text, numeric, date, values list, cross-reference, user/groups...), key field flag… |
archer_list_application_fields | Field definitions of every level of an application in one call: id, name, alias, type and related ids |
archer_get_field | One field definition by id with its type, alias, level, required flag and, for values-list fields, the values list id |
archer_get_values_list | The values of a values list (the choices behind a values-list field) as a flat list with value id, name, numeric value and parent |
archer_get_record | One record (content) by its content id through the platform API: level id, sequential id and every field value keyed by field id |
archer_get_field_values | Values of chosen fields for chosen records in one call (a POST that only reads) |
archer_list_content_endpoints | The levels (and cross-references) published through the Content API that this Archer user can read, with the case-sensitive alias to pass… |
archer_query_records | Records of one level through the Content API (OData): readable field aliases instead of ids, with $filter, $select, $orderby and paging (at… |
archer_get_content_record | One record of a level through the Content API by its tracking id, with field values keyed by field alias |
archer_list_users | Archer user accounts with id, user name, first and last name, display name, account status and last login |
archer_list_groups | Archer groups with id, name and description |
Example prompts
- "List the applications in our Archer instance and tell me which ones hold risks, findings and incidents."
- "Show me all open findings whose due date has passed, grouped by owner."
- "Which risks in the risk register are rated high, and who owns each of them?"
- "Rebuild our monthly incident report: incidents opened last month by category and status."
Next steps
Was this guide helpful?
