Cost control: a monthly token allowance for each modelSee how it works
memtro
Start for free

SecurityScorecard + Memtro

Which of our vendors' security scores have dropped, and why?

SecurityScorecard shows you portfolios of monitored vendors with each company's grade, score and 30-day change. It reads a company's scorecard with factor grades, score history and the events that moved it, plus your vendor records and notes. When asked and granted, it can create, rename or delete portfolios and add or remove companies. It can also create tags, tag or untag companies, update a vendor's details, or unfollow a vendor. SecurityScorecard can tell Memtro as it happens when a score changes or a breach is reported, and a job can start on it. Generating a token revokes your previous one.

Connect SecurityScorecardStart for freeReference
In Memtro

What you can do with SecurityScorecard in Memtro

Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right SecurityScorecard tool, reads what it needs, and answers with the source cited.

What it does

  1. 01Lists portfolios and their companies with grade, score, 30-day change and industry.
  2. 02Reads any company's scorecard by domain, with factor grades, score history and the events that moved it.
  3. 03Reads your record of a followed vendor, scorecard tags and your team's notes.
  4. 04When asked and granted, creates, renames or deletes a portfolio, or adds a company, which may count against your plan.
  5. 05When asked and granted, tags or untags a company, updates a vendor's lifecycle, risk and contract details, or stops following it.
  6. 06With events on, a score rise or fall, new issues or a reported breach can start a job.

Acts when asked

When you ask it to

These tools change something in SecurityScorecard. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.

  1. 01Create a portfolio
  2. 02Rename a portfolio or change its description or sharing
  3. 03Delete a portfolio
  4. 04Add a company to a portfolio (starts monitoring it)
  5. 05Remove a company from a portfolio
  6. 06Create a scorecard tag
  7. 07Tag a company
  8. 08Remove a tag from a company
  9. 09Update a vendor's lifecycle, risk, business unit and contract details
  10. 10Stop following a company and delete its vendor data

Events

When it happens

Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in SecurityScorecard, choosing the same kinds; the tab shows SecurityScorecard's own steps. Each event can start a job, with the event as its input. SecurityScorecard sends a secret with every delivery, and one without it is refused.

Events and webhooks
  • 01A scorecard's score rose or fell
  • 02New or changed issues on a scorecard
  • 03A new breach was reported for a scorecard
In practice

Ask it like you would a colleague

Once SecurityScorecard is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.

SecurityScorecard + Memtro

  • Which vendors' scores fell in the last 30 days?

  • What is northwind.com's grade, and which factors are weakest?

  • Why did acme.com's score drop last week?

  • When does our payroll vendor's contract end?

  • Which companies are in the critical vendors portfolio?

01

Quarterly vendor review

Maya Okafor, risk manager at Acme Ltd, asked how the critical vendors portfolio was trending. Memtro listed each company's grade, score and 30-day change, and the events behind the largest drop.

02

A vendor's score falls

When a vendor's score fell, a job started for Dan Fletcher, security lead at BigCo. It read the company's score events and vendor record, and summarised the new issues and the vendor's business impact.

Teams

Where it fits

The teams that lean on SecurityScorecard most, a question each of them asks, and what they connect beside it.

Better together

Works with

A record in SecurityScorecard is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.

Also in Engineering and operations

Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.

Setup

How to connect

Connect withAPI token
  1. 1

    In SecurityScorecard open My Settings, then API, and generate a token. A bot user's token avoids revoking yours, and a Read Only bot keeps Memtro to reading.

  2. 2

    In Memtro open Connections → SecurityScorecard and paste the API token.

  3. 3

    An administrator grants the portfolio, tag and vendor actions by name. Events are turned on from the connection's Events tab, and the address is then added as a rule in SecurityScorecard's settings.

  4. 4

    Ask: which vendors' scores fell in the last 30 days?

Also works from

Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The SecurityScorecard tools are the same everywhere.

Set it up as an MCP serverClients and agents
FAQ

Questions

Can Memtro change anything in SecurityScorecard?+

Only when you ask, and only what it has been granted: create a portfolio; rename a portfolio or change its description or sharing; delete a portfolio; add a company to a portfolio (starts monitoring it); remove a company from a portfolio; create a scorecard tag; tag a company; remove a tag from a company; update a vendor's lifecycle, risk, business unit and contract details; stop following a company and delete its vendor data. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.

Who can use a SecurityScorecard connection?+

A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.

Does Memtro store my SecurityScorecard data?+

Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.

How do I connect SecurityScorecard?+

API token. In SecurityScorecard open My Settings, then API, and generate a token. A bot user's token avoids revoking yours, and a Read Only bot keeps Memtro to reading.

Can SecurityScorecard start a job?+

Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in SecurityScorecard, choosing the same kinds; the tab shows SecurityScorecard's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.

Connect SecurityScorecard in a few minutes

Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.

Start for freePricing

Where agents remember your company

Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.

Start for freeGetting started

7-day free trial · card on file, nothing charged until it ends · cancel any time