In Drata, list every monitoring test that is failing, group the findings by owner, and tell me which ones are out of scope so we can exclude them with a reason I approve.
Drata watches your stack all day and tells you what fails: a repository without branch protection, a laptop without disk encryption, a person who has not accepted a policy. Then someone has to open each test, read the findings, decide what is real and what is out of scope, and act. That is the part that waits.
Failing tests are spread over many pages, each with its own list of resources. An exclusion needs the right resource, picked in the test's findings, and a reason good enough for an auditor. Checking whether a leaver is still a Drata user is another trip to the settings. None of it is hard, but all of it is manual, and it comes back every week.
Reduck is an MCP server whose Drata scripts run in your own Chrome, signed in as you. Your agent reads what you see in Drata and acts only when you ask. The Reduck team runs its own compliance in Drata with these scripts.
A typical weekly review, in one request:
Run your quarterly user access review with Claude, ChatGPT or any MCP client. Your agent exports users and roles from GitHub, Slack, Notion, Vercel and the rest of your stack, flags who should not be there, and removes leavers with proof.
IT opsPull every member and role across your stack, then offboard someone with proof nobody else moved.
IT opsDrive the internal tool that has no API: create accounts, populate data, export reports and update records.
IT ops