ISMS Copilot + OpenCode: compliance work in your harness
OpenCode connects to ISMS Copilot two ways: a remote MCP server entry in opencode.json with a personal access token, or the OpenAI-compatible Model API registered as a provider for plain chat turns. Your agent reads the file; the specialist answers with the clause; you sign.
What each side does
OpenCode is the harness: it owns your repository, your shell and your files, and its built-in agents handle the software work. ISMS Copilot is the GRC specialist it can hand compliance questions to: framework knowledge by clause, policy and SoA drafting, gap analysis, audit prep. The two paths fit different jobs. The MCP server is for delegation: your build agent opens an ISMS Copilot conversation mid-task and gets the answer back as a tool result. The Model API is for plain compliance turns: a chat model your custom agent can call without tools. Both run on what you already pay for: the MCP connection rides your chat plan, the API runs on prepaid credits.
Use ISMS Copilot from coding agents →Connect over MCP
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ismscopilot": {
"type": "remote",
"url": "https://account.ismscopilot.com/v1/account/mcp",
"oauth": false,
"headers": {
"Authorization": "Bearer {env:ISMS_COPILOT_TOKEN}"
}
}
}
}In opencode.json or opencode.jsonc. oauth is false because this path uses a personal access token, and the {env:} reference keeps the token out of committed files. Create the token in chat.ismscopilot.com under Settings, Connected apps.
Or register the Model API as a provider
{
"provider": {
"ismscopilot": {
"npm": "@ai-sdk/openai-compatible",
"name": "ISMS Copilot",
"options": {
"baseURL": "https://api.ismscopilot.com/v1",
"apiKey": "{env:ISMS_API_KEY}"
},
"models": {
"isms-fast": { "name": "ISMS Copilot Fast" },
"isms-thinking": { "name": "ISMS Copilot Thinking" }
}
}
}
}For plain compliance turns. Do not set it as your global model: OpenCode's built-in agents send tool definitions this endpoint rejects. Use it for plain chat turns, or point a custom agent with tools disabled at it.
Jobs to hand over
Check a policy or procedure in your repo against the control you name
Draft SoA justifications and risk treatment rows from what you paste
Compare the SoA and the risk register in your repo, then ask which differences an auditor would raise
Name the record type each applicable control needs for evidence
Answer framework questions with the clause, not a guess from memory
Tell your agent when to delegate
OpenCode reads AGENTS.md. Put the routing rule at your project root, or in your global instructions, and your build agent hands compliance work to the MCP server instead of answering from memory: send the question plus a short excerpt of the relevant lines, never a whole document, and keep code, git and shell work local. The paste-ready rule for OpenCode, Codex and Grok is on the docs page below.
Routing rules for OpenCode and other agents →Frequently Asked Questions
MCP or API key, which one?
MCP for delegation from your coding agent: it keeps conversation state, modes and workspaces, and runs on your chat plan. The API key for plain compliance turns and scripts, on prepaid credits. Both work side by side in the same opencode.json.
Can I make ISMS Copilot my default model in OpenCode?
No. The Model API endpoint is text-only: OpenCode's built-in agents send tool definitions it rejects. Use it for plain chat turns, or point a custom agent with tools disabled at it, and keep your coding model for coding. The exact agent setup is on the docs page.
Does OpenCode send my repository to ISMS Copilot?
No. Over MCP, only the message your agent writes travels, plus the excerpt it chooses to include for policy, SoA or register questions. Over the API, only what your code sends in the request.
Is OpenCode supported?
OpenCode connects with the same remote MCP shape as Cursor and Codex: the endpoint URL and a Bearer header with a personal access token. If tools do not appear after adding the server, restart OpenCode and check the token was not truncated.
Who is this page for?
GRC engineers and developers who work in OpenCode and want the compliance specialist one hand-off away. Compliance managers who do not use a terminal: use the web workspace.
Give OpenCode a compliance specialist
One config entry, one token. Your agent keeps the code; the framework answers come from the specialist.