# Roadmap > Planned psLens capabilities, with stable phrasing about commitment. No published dates. --- LLMS index: [llms.txt](/llms.txt) --- ## Roadmap This page lists what is planned but not yet shipped in psLens. Items are grouped by area. Two rules apply throughout: - **No committed dates.** If you need a date for a procurement decision, raise it during contracting. - **Customer-driven priority.** If a planned item matters for a deal or a deployment, that moves it up the queue. Reach out via the [contact page](/contact/). The published-stable phrasing on this site is intentionally conservative. "Planned" means we intend to build it. It does not mean we have started. ## psLens as MCP Servers The largest planned area is exposing psLens through the [Model Context Protocol](https://modelcontextprotocol.io) so AI tools (Claude Code, Claude Desktop, Cursor, Continue, and any other MCP-aware host) can query PeopleSoft live, without anyone running an export by hand first. The current AI Enablement story documented at [AI Enablement](/docs/use-cases/ai-enablement/) is the **export-and-paste** workflow. MCP removes the manual step. The same whitelisted read surface that backs the dashboard becomes the surface the agent calls. We expect to ship this as two distinct MCP servers so customers can grant exactly the access their security model allows: - A **read MCP** that mirrors the dashboard browse surface. Read-only against the SWS framework, same whitelist as the UI. - An **action MCP** that exposes the operations the dashboard already lets an authenticated user perform (running reports, refreshing whitelist caches, kicking off project comparisons). Optional; not every deployment will enable it. The use cases below describe what each MCP unlocks. ### 1. Metadata Research MCP The core case. Every PeopleSoft object psLens browses becomes a tool the agent can call: records, fields, projects, application packages, app engines, components, pages, menus, queries, service operations, permission lists, users, message catalog entries, SQL objects. **Example agent prompt:** > Open my customization repo. For every Application Engine in project `HCM_CUST_2026`, summarize what it does in two sentences, list its temp tables, and flag any that reference deprecated meta-SQL. Today this requires exporting each AE to Markdown, copying them into the workspace, and prompting against the saved files. The metadata MCP lets the agent walk the project itself and pull each AE on demand. ### 2. Security & Access MCP Surfaces the same data the security dashboard exposes (users, roles, permission lists, web service authorizations) as a question-and-answer tool for ad-hoc audit conversations. **Example agent prompt:** > Does the user `J_PETERS` have access to the `PROCESS_MONITOR` component on PROD? Show me the role-and-permission-list chain that grants it, or confirm there is none. The agent traces the access path live without the operator pulling a full report or writing the 4-table join by hand. ### 3. Operations & Alerts MCP The Process Scheduler, Integration Broker, and alert history surfaces are exposed as live tools. **Example agent prompt (2am triage):** > Production looks sick. Pull the last 30 minutes of alert history, the current Process Monitor failure list, and the IB queue depth on PROD. Tell me what is most likely the root cause and the next thing to check. The agent correlates across surfaces (a queued process plus a locked OPRID plus a stalled IB dispatcher) faster than a person clicking through three different pages. ### 4. Reports MCP The 14 on-demand reports already available in the dashboard (Full Access, Stale Passwords, Node Security Audit, Dangerous Permissions, and the rest) become tools the agent can invoke and consume. **Example agent prompt (recurring cadence):** > Run the security report bundle against PROD. Compare the findings to last week's run, summarize what changed, and write a one-page Slack-ready summary highlighting any new account that gained broad access. This is the highest-value case for security teams that want a weekly or monthly audit cadence without writing the orchestration themselves. ### 5. Cross-Environment Comparison MCP Project Compare and Recurring-Process Compare are already in psLens. As MCP tools they let an agent answer drift questions across DEV, TEST, and PROD without anyone clicking through the comparison UI. **Example agent prompt (post-migration):** > A migration ran last night moving project `HCM_RELEASE_42` from TEST to PROD. Pull the project compare, list every object that differs between TEST and PROD now, and tell me which differences are expected (newly added) versus suspicious (changed in a way that suggests a botched merge). ### What this is not - **Not a write path to PeopleSoft.** Neither MCP exposes a way to change PeopleSoft data. psLens is read-only against PeopleSoft today and stays that way. - **Not a SaaS shared MCP.** Each customer's MCP servers point at their own psLens instance, same single-tenant model as the dashboard. - **Not coupled to a specific AI vendor.** MCP is an open protocol. Any client that speaks it works. ## Other Roadmap Items These are documented in context on the page where the reader is likely asking the question. The roadmap page lists them here so a reviewer can see the full surface in one place. ### Authentication - **Native OIDC inside psLens.** Configure your IdP directly in `config.yaml` without a reverse-proxy hop. See [Authentication & Access → Native SSO](/security/authentication-and-access/#4-native-sso-on-the-roadmap). - **Admin-facing "kill all sessions" UI.** Today the path is `nats kv del auth-sessions`. See [Authentication & Access → Session Management](/security/authentication-and-access/#5-session-management). ### Audit and Logging - **First-class user-action audit log.** Structured per-user event log written to NATS KV with configurable retention, exportable to your SIEM. Targeted to land alongside native SSO. See [Data Handling & Logging → Audit Logging](/security/data-and-logging/#5-audit-logging). - **Self-service master-key rotation.** Today this is a Cedar Hills Group-assisted operation. See [Data Handling & Logging → Master Key Management](/security/data-and-logging/#4-encryption). ### Observability - **Prometheus `/metrics` endpoint.** For customers who want metric-based monitoring in addition to the existing `/healthz` + log stream. See [Deployment & Operations → Monitoring](/security/deployment-and-operations/#6-monitoring). ### Compliance - **SOC 2 certification.** Cedar Hills Group is not SOC 2 certified today. See [Compliance & Vendor → SOC 2](/security/compliance-and-vendor/#1-soc-2--current-posture). ## How to influence the roadmap Three ways an item moves up the queue: 1. **It blocks a deal.** Tell us during contracting. 2. **It blocks a deployment in progress.** Tell us in the customer Slack channel or via the [contact page](/contact/). 3. **It is something many customers have asked for independently.** We watch for patterns across customer conversations and re-rank when one emerges. We do not run a public voting board. We do read every email.