Is there an official ISMS Copilot MCP server?

Yes. It is hosted at https://account.ismscopilot.com/v1/account/mcp, uses Streamable HTTP, and authenticates with a pat-isms personal access token. It is listed in the official MCP Registry as io.github.tristanroth1/ismscopilot-account.

Is this Microsoft Copilot or GitHub Copilot?

No. ISMS Copilot is an independent compliance AI made by Better ISMS (ismscopilot.com). Microsoft Copilot Studio and GitHub Copilot MCP instructions do not apply to it.

Do I need a paid plan to use the MCP server?

No. The MCP server works on every plan, including Free. Free runs the fast mode only, within the 10 messages per 4 hours limit. Think and Beyond modes need a paid plan.

Can my agent set itself up?

Yes, except for the token. Point the agent at the official setup prompt, https://docs.ismscopilot.com/agent-setup/prompt.md. It writes the MCP config, adds a routing rule and runs a smoke test. The human creates the token in Settings, Connected apps.

Is there an npm package or local server to install?

No. It is a hosted remote server. Add the URL and the Authorization header to your MCP client.

ISMS Copilot MCP server

The official remote MCP server for ISMS Copilot, the specialist AI for ISO 27001, SOC 2, GDPR, NIS 2, DORA and the EU AI Act. Your coding agent stays the harness and hands compliance steps to ISMS Copilot over MCP. ISMS Copilot (ismscopilot.com) is not Microsoft Copilot or GitHub Copilot.

https://account.ismscopilot.com/v1/account/mcp

Create a token

At a glance

Endpoint: https://account.ismscopilot.com/v1/account/mcp
Transport: Streamable HTTP (remote). Nothing to install, no npm package, no local process.
Auth: Authorization: Bearer pat-isms-...
Token: Created by the human at chat.ismscopilot.com, Settings, Connected apps. Shown once. Your agent cannot create it.
Plans: Every plan, including Free. Free runs the fast mode only, 10 messages per 4 hours. Think and Beyond modes need a paid plan.
Billing: Your ISMS Copilot chat plan. No separate agent plan, no per-token billing.
Server name: ismscopilot (tools appear as mcp__ismscopilot__* in Claude Code)
MCP Registry: io.github.tristanroth1/ismscopilot-account

If you are an AI agent

Fetch the official setup prompt and follow it: https://docs.ismscopilot.com/agent-setup/prompt.md. It covers the already-connected, not-connected and repair cases, writes the MCP config without committing the token, adds a routing rule and runs a smoke test. Do not invent another URL, package or API key. You cannot create the token: ask the human to create it in Settings, Connected apps.

Set up in four steps

1Sign up at chat.ismscopilot.com (free, no card), then open Settings, Connected apps.
2Create a token with the Agent delegation preset. It grants account:read, workspaces:read, conversations:create, company_context:read and memories:read, with no write scopes. Copy the pat-isms- value once.
3Put it in an environment variable, for example export ISMS_COPILOT_TOKEN="pat-isms-..." in your shell profile, so the token never lands in a committed file.
4Add the server to your client with the config below, restart the client, and ask: list my ISMS Copilot workspaces.

Config for your client

Claude Code

Terminal, user scope so it works in every folder

claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp --header 'Authorization: Bearer ${ISMS_COPILOT_TOKEN}'

Keep the single quotes: Claude Code stores the ${ISMS_COPILOT_TOKEN} placeholder and expands it at start. Restart, then run /mcp to verify.

Cursor

~/.cursor/mcp.json (global, not a committed project file)

{
  "mcpServers": {
    "ismscopilot": {
      "url": "https://account.ismscopilot.com/v1/account/mcp",
      "headers": {
        "Authorization": "Bearer ${env:ISMS_COPILOT_TOKEN}"
      }
    }
  }
}

Merge into existing mcpServers. If Cursor started from the dock does not see the variable, put the literal token in the global file.

Codex

~/.codex/config.toml

[mcp_servers.ismscopilot]
url = "https://account.ismscopilot.com/v1/account/mcp"
bearer_token_env_var = "ISMS_COPILOT_TOKEN"

Older Codex builds without bearer_token_env_var take an [mcp_servers.ismscopilot.http_headers] table with the Authorization header.

Any other MCP client (OpenCode, Grok, Hermes, Windsurf, VS Code)

The client's MCP config

{
  "mcpServers": {
    "ismscopilot": {
      "type": "http",
      "url": "https://account.ismscopilot.com/v1/account/mcp",
      "headers": { "Authorization": "Bearer pat-isms-..." }
    }
  }
}

Same URL, same Bearer header. The exact key names vary by client.

Step-by-step guides: Claude Code, Cursor, and the product docs for every client.

claude.ai, Claude Desktop and ChatGPT connectors

claude.ai personal accounts (Free, Pro, Max) can connect today if Claude shows the Request headers beta: Customize, Connectors, Add custom connector, Authentication No sign-in, then a request header authorization with the value Bearer and your token. Never add it in a Claude Team or Enterprise organization: every member would act as you. Claude Team and Enterprise, Claude Desktop sign-in and ChatGPT connectors need OAuth, which is in progress.

Tools

Each tool needs the matching scope on the token. Full list with scopes and limits on ISMS Copilot for Agents.

create_conversation, send_message, get_reply: ask the specialist. Fast mode by default; replies are asynchronous, poll get_reply until complete.
get_account_info, list_workspaces, create_workspace: who you are and which client workspaces exist.
list_documents: generated documents, metadata only.
list_memories, create_memory, update_memory: what your agent learns stays with your account.
get_company_context, set_company_context: the company profile set under Customize.
list_api_keys, create_api_key, revoke_api_key, get_api_credit_balance, create_api_credit_checkout: the separate Model API plane.

Questions

Is there an official ISMS Copilot MCP server?: Yes. It is hosted at https://account.ismscopilot.com/v1/account/mcp, uses Streamable HTTP, and authenticates with a pat-isms personal access token. It is listed in the official MCP Registry as io.github.tristanroth1/ismscopilot-account.
Is this Microsoft Copilot or GitHub Copilot?: No. ISMS Copilot is an independent compliance AI made by Better ISMS (ismscopilot.com). Microsoft Copilot Studio and GitHub Copilot MCP instructions do not apply to it.
Do I need a paid plan to use the MCP server?: No. The MCP server works on every plan, including Free. Free runs the fast mode only, within the 10 messages per 4 hours limit. Think and Beyond modes need a paid plan.
Can my agent set itself up?: Yes, except for the token. Point the agent at the official setup prompt, https://docs.ismscopilot.com/agent-setup/prompt.md. It writes the MCP config, adds a routing rule and runs a smoke test. The human creates the token in Settings, Connected apps.
Is there an npm package or local server to install?: No. It is a hosted remote server. Add the URL and the Authorization header to your MCP client.

Registry entry: official MCP Registry. Machine-readable connect protocol: /api/public/connect/v1. Facts checked on 2026-10-06 against the live endpoint, the official setup prompt and the ISMS Copilot app.

Create a token and connect

Settings, Connected apps, Agent delegation preset. Then paste the config for your client.

Create a token