{"generatedAt":"2026-09-12T06:33:13.141Z","source":"ismscopilot-marketing","contract":"v1","product":"isms-copilot-account-mcp","canonicalHumanPage":"https://www.ismscopilot.com/resources/connect-from-claude-code","docsPage":"https://docs.ismscopilot.com/docs/agents","mcpEndpoint":"https://account.ismscopilot.com/v1/account/mcp","note":"Curated connect protocol for agents. Prefer mode=fast unless asked for think or beyond; poll get_reply on generating. Not waitlist.","markdown":"# Connect ISMS Copilot from an MCP client (agent guide)\n\nMachine-readable connect protocol for coding agents. Human how-to: https://www.ismscopilot.com/resources/connect-from-claude-code  \nProduct docs: https://docs.ismscopilot.com/docs/agents\n\n## Status\n\n**Live in production.** Create a personal access token, point your MCP client at the account endpoint, act as the user within granted scopes. The account knowledge includes first-class US frameworks (SOC 2, HIPAA, NIST, CMMC, CCPA) as well as ISO 27001 and EU regimes. Usage is covered by the user's chat subscription (not prepaid API credits).\n\n## Endpoint\n\n```\nhttps://account.ismscopilot.com/v1/account/mcp\n```\n\n- Transport: HTTP MCP (Streamable HTTP)\n- Auth header: `Authorization: Bearer pat-isms-…`\n- Token prefix: `pat-isms-` (shown once at creation)\n\n## Create a token (human step)\n\n1. Open https://chat.ismscopilot.com\n2. **Settings → Connected apps → Create token**\n3. Name it (e.g. `claude-laptop`), pick scopes, optional expiry\n4. Copy the secret immediately\n\nRevoke anytime on the same page.\n\n## Claude Code\n\n```bash\nclaude mcp add --scope user --transport http ismscopilot \\\n  https://account.ismscopilot.com/v1/account/mcp \\\n  --header \"Authorization: Bearer pat-isms-...\"\n```\n\nKeep `--scope user` so the server is available in every folder. Restart Claude Code after adding (`/exit` then `claude`). Verify with `/mcp`.\n\n## Other clients (Cursor, Codex, Hermes, …)\n\nSame URL and Bearer header. Configure whatever MCP HTTP server entry the client supports.\n\n## Scopes (grant least privilege)\n\n| Capability | Typical scope intent |\n| --- | --- |\n| Account info | read |\n| Workspaces | list / read |\n| Documents | list metadata only (no get-by-id file download tool) |\n| Memories | read; create/update if granted |\n| Conversations | create / send messages if granted |\n\nExact UI labels may vary slightly; grant the minimum for the job.\n\n## Tools (high level)\n\n- `get_account_info`, `list_workspaces`\n- `list_documents`\n- `list_memories`, `create_memory`, `update_memory`\n- `create_conversation`, `send_message`, `get_reply`\n\n## Modes: prefer fast unless asked\n\n`create_conversation` and `send_message` accept optional `mode`:\n\n| mode | Meaning |\n| --- | --- |\n| `fast` (default) | Normal answers; usually returns inline in a few seconds. Used when `mode` is omitted. |\n| `think` | Deeper reasoning; paid plans only (non-paid falls back to fast). Often slower. |\n| `beyond` | Multi-step plan / draft / verify. Paid plans only, 10 runs per UTC day. Minutes-scale. Pass `mode: \"beyond\"`. The call often returns `status: \"generating\"` with `beyond_run_id`; poll `get_reply` every 10-20 seconds until `complete`. Fast GLM-5.3 runs can finish inside the first call. If Beyond cannot run, the turn answers via the normal flow and the result carries `beyond_denied_reason`. |\n\n**Agents should default to `mode: \"fast\"`** unless the human explicitly asks for Think or Beyond. The server does not auto-upgrade a hard question. “Think carefully about this” is enough for Think. “Use Beyond” / “run this in Beyond” is enough for Beyond.\n\n## Async replies (`generating` → `get_reply`)\n\nLonger turns (especially `think`) may return:\n\n```json\n{\n  \"conversation_id\": \"…\",\n  \"message_id\": \"…\",\n  \"status\": \"generating\"\n}\n```\n\nwithout a `response` field. Then:\n\n1. Call `get_reply` with those ids.\n2. Poll every few seconds (about 2–5s). `get_reply` may long-poll briefly; do **not** sleep 30–90s between polls.\n3. Stop when `status` is `complete` (use `response`) or `error`.\n4. Do not send another message on the same conversation while the previous turn is still generating (server rejects with conflict).\n\nIf still generating after roughly two minutes, surface that to the human or start a **new** conversation with `mode: \"fast\"`. Do not open parallel think turns.\n\n## Security\n\n- A token **acts as the user**. Treat it like a password.\n- Never commit tokens to git or paste into public issues.\n- Revoke on lost laptop / rotated CI secrets.\n- Tokens do not unlock the model API (`sk-isms-…`) or Embed partner billing.\n- Toggling Advanced Data Protection is **not** available over MCP.\n- Beyond **is** available when the agent passes `mode: \"beyond\"` (Fast is the default).\n\n## Related machine endpoints\n\n- Agents product blurb: `GET https://www.ismscopilot.com/api/public/agents/v1`\n- Pricing summary: `GET https://www.ismscopilot.com/api/public/pricing/v1`\n- Product changelog: `GET https://www.ismscopilot.com/api/public/changelog/v1`\n- Framework list: `GET https://www.ismscopilot.com/api/public/frameworks/v1`\n","byteLength":4601}