ISMS Copilot for GRC engineers

Your harness stays. Add a compliance step.

If your GRC workflow already uses Claude Code, Cursor, or Codex, keep that harness for orchestration. Call ISMS Copilot for the compliance step. The Model API injects curated framework modules before the answer and discloses them per response. The public catalog lists 100+ framework modules and remains authoritative for current coverage; modules carry edition stamps and last-verified dates.

What each plane costs

Account MCP (pat-isms)

Fixed cost: your existing chat subscription. No per-token billing, no credits, no spend caps to configure. Conversations run inside your plan's 4-hour UTC session window; Think mode needs a paid plan.

Model API (sk-isms)

Metered: prepaid credits, per-token, with per-key spend caps for unattended agents. The comparator below carries the rates with sources.

Model API cost comparison, observed 2026-08-26

Sources and fine print for the table above

The blended column is an illustrative compliance mix of 75% input and 25% output, because compliance work reads far more than it writes; your mix will differ. Anthropic rates come from Anthropic's published pricing page and ours from our console, both observed 2026-08-26. Prices can change, and the vendor pages and the console win when they do. The † marks the newer Claude tokenizer, which Anthropic's documentation says applies to the Claude 5 models and produces roughly 30% more tokens for the same text; the list multiplication does not include that effect. Anthropic's Batch API and prompt caching are real mitigations and belong in your math if your workload fits them. What no discount fixes: on a raw model API, grounded compliance output requires the reference corpus in the prompt, and that corpus is yours to license, assemble, and keep current. Here the knowledge is the included part. We claim no quality superiority over Claude; no head-to-head against raw frontier models exists yet, and the record we do publish carries its own caveats.

Comparator sources

• Anthropic pricing page

  Claude list rates, observed 2026-08-26

• ISMS Copilot console pricing

  Live unit rates, source of truth; prices can change and the console wins when they do

Two planes, and when to use each

1. 01

   Account MCP: your agent talks to the specialist, on your chat subscription

   Create a personal access token (pat-isms-) at chat.ismscopilot.com under Settings, Connected apps, then run the one-liner above. Cursor and Codex take the same URL and Authorization header as an MCP server entry. Your agent can hold real ISMS Copilot conversations (Fast and Think) and read your workspaces, memories, and company context. Usage rides your chat plan's 4-hour session window; read tools keep working after the cap.

2. 02

   Model API: the compliance sub-agent step

   Create an sk-isms key at platform.ismscopilot.com/keys. Completions require a positive prepaid credit balance, separate from the chat subscription. The endpoint is OpenAI-compatible and text-in/text-out: no tool definitions, no JSON mode. Claude Code speaks the Anthropic API shape, so the documented pattern for tool-using harnesses is a plain completion your agent triggers from a script, while your orchestrator keeps the general model for code. Set a per-key spend cap (hour, day, week, or month) so an unattended loop cannot burn the balance.

   curl https://api.ismscopilot.com/v1/chat/completions \
     -H "Authorization: Bearer sk-isms-..." \
     -H "Content-Type: application/json" \
     -d '{
       "model": "isms-thinking",
       "messages": [{ "role": "user", "content": "Map A.5.23 to SOC 2 and draft the control statement." }],
       "ismscopilot": { "frameworks": ["ISO_27001", "SOC_2"] }
     }'

   Copy
3. 03

   Pin the framework, do not hope for detection

   Auto-detection scans user messages and the last assistant turn. It does not scan system or developer messages, and harness instructions usually live in the system prompt, so auto can miss inside an agent loop. Send the ismscopilot extension with exact catalog ids instead (up to eight per call).

Framework mappings, stated honestly

A mapping request returns model-generated text. Pin exact catalog ids; the response identifies the curated modules injected through the x-isms-frameworks header and the ismscopilot response object, and the answer states when a correspondence is indicative rather than official. Treat the result as a draft for human verification, not an official crosswalk or source citation. The API does not offer a mappings endpoint today. What you get is a mapping you can read, check, and paste, grounded in the edition you pinned.

Two planes, two credentials, do not mix them

Account MCP

pat-isms token. Workspaces, memories, company context, real ISMS Copilot conversations (Fast/Think). Covered by your chat subscription and its 4-hour session window; no separate billing.

Model API

sk-isms key. OpenAI-compatible text-only completions with framework injection, for scripts and sub-agent steps. Prepaid credits, per-key spend caps, live rates in the console.

Not over MCP

The Advanced Data Protection toggle is web-only today.

EU path

The API's EU aliases run on Mistral's EU-bound inference host with zero retention of request content. Pinning is a routing choice here, not a premium tier.

Framework catalog

The live catalog at GET /v1/frameworks is authoritative and public; module ids, versions, and last-verified dates come from it, not from this page.

Works with your harness

• Claude Code

  One-line MCP install above; Model API runs as a sub-agent step (Anthropic API shape)

• Cursor

  HTTP MCP entry with the same URL and Authorization header; Model API via the caveated OpenAI-compatible override

• Codex

  Same MCP URL and Bearer header

• opencode, Continue, Aider, Cline

  Model API as an OpenAI-compatible text-only provider; Aider runs directly, others via chat roles or the sub-agent step

• Any HTTP MCP client

  Streamable HTTP transport, Bearer header, scopes you grant

Sources and product truth

• Account MCP docs

  Connect any MCP client: tokens, endpoint, per-client notes

• API coding-agent guide

  Sub-agent pattern, harness configs, pinning in agent loops

• Framework knowledge

  Injection modes, disclosure contract, catalog ids

• Credits and limits

  Prepaid credits, spend caps, welcome credit rules

• API zero-data retention

  What is and is not stored on the Model API plane

• Model quality record

  Published evals with sample sizes and caveats

• Public framework catalog

  GET /v1/frameworks, the authoritative module list

• Anthropic pricing page

  Claude list rates, observed 2026-08-26

• ISMS Copilot console pricing

  Live unit rates, source of truth

What a free account can and cannot do

The Account MCP works from any account, including the free tier: create a pat-isms token, connect your harness, and conversations run under your plan's session window (the free window is smaller; paid plans scale it, and Think mode needs a paid plan). The Model API runs on prepaid credits that are separate from the chat subscription: create an sk-isms key, top up in the console, and set a spend cap. If you are evaluating, connect MCP first, then add credits when you wire the sub-agent step.

The honest limit list

Text-in, text-out: no tool calling, no JSON mode, no multimodal input; streaming is supported. The API is not your agent's model backend in Claude Code; it is the sub-agent step, or a text-only provider in harnesses that support one. Grounded is not infallible: the modules are maintained and disclosed, the model can still be wrong, and risk acceptance stays with you. Answers are compliance guidance, not an audit opinion.

Running compliance as a document project instead?

If the work is document-heavy rather than repo-shaped, the web workspace is the better plane: uploaded evidence, persistent workspaces, audit-shaped outputs. The workspace, the Account MCP, and the Model API are three doors to the same specialist engine.

Frequently Asked Questions