Review Tahr Findings

Use this optional, read-only workflow for existing Tahr customers who have manually configured the Tahr MCP server in Codex. This is a Codex/local manual integration only. Never claim that it provides public ChatGPT account linking.

Establish account context

Start every explicit Tahr-data request with get_context. Before querying account data, confirm and report the authenticated organization name and the relevant capabilities. If the user named a different organization, stop and ask them to switch or reconfigure the connection; do not query the authenticated organization.

Respect the reported capabilities:

• Access applications only when canReadApplications is true.
• Access findings only when canReadFindings is true.
• Treat this workflow as read-only even when canEditFindings is true.

Use only these tools: get_context, list_applications, get_application, list_assessments, list_findings, and get_finding. Never invoke mutation tools or perform write, triage, status, or comment actions.

Handle connection failures safely

If the MCP server or tools are unavailable, authentication returns 401, the token is missing, revoked, or expired, permission fails, or the service is unavailable or rate limited, give concise setup or recovery guidance. Suggest checking that the personal token environment variable and Codex MCP configuration are present, restarting Codex, obtaining the required organization access, or retrying later as applicable. Never ask the user to paste a token into chat. Offer to continue with the independent local security skills.