A compliance specialist your agent can call.

Works with

• Claude Code

  The one-line install above. Restart, then /mcp to verify.

  One line
• Cursor

  HTTP MCP server entry: the URL plus the Authorization header.

  Config
• Codex

  Same URL, same Bearer header.

  Config
• OpenCode and Grok

  Same URL, same Bearer header in the client's MCP config.

  Config
• Hermes and any HTTP MCP client

  Streamable HTTP transport, Bearer token. Config for every client on the MCP server page.

  Config
• claude.ai and Claude Desktop

  Custom connector with the server URL, advanced OAuth fields left empty, then sign in to ISMS Copilot and approve. Each person connects their own account.

  Live
• Claude Team and Enterprise connectors

  An Owner adds the custom connector once; each member connects with their own ISMS Copilot account.

  Live
• ChatGPT

  Custom MCP app (developer mode) with the server URL and OAuth, default settings, then sign in to ISMS Copilot and approve.

  Live

Your agent is the harness, ISMS Copilot is the specialist

Keep your agent doing what it does well: reading the repo, running tools, editing files. When a step turns on ISO 27001, SOC 2, GDPR, NIS 2, DORA or the EU AI Act, it hands that step to ISMS Copilot over MCP and carries on with the answer.

Any other client

{
  "mcpServers": {
    "ismscopilot": {
      "url": "https://account.ismscopilot.com/v1/account/mcp",
      "headers": { "Authorization": "Bearer pat-isms-..." }
    }
  }
}

The same endpoint and header in the JSON shape most clients accept.

Tools

Twenty-four tools on the live server, grouped by plane. With a personal access token, each needs the matching scope on the token. A sign-in (OAuth) connection from Claude or ChatGPT can see up to 19, filtered by the scopes you approve, and never the Model API key and credit tools.

• create_conversation, send_message, get_reply

  Ask the specialist. Fast by default, think on paid plans.

  Conversations
• get_account_info, list_workspaces

  Who you are, which client workspaces exist.

  Account
• create_workspace

  Create a personal workspace (workspaces:write). It starts unshared and does not inherit organization Advanced Data Protection; share it in the web app. Up to 10 new workspaces per 24 hours.

  Account
• list_documents

  Names and details of documents uploaded in the web app. No content, no download and no upload over MCP.

  Account
• list_memories, create_memory, update_memory

  What your agent learns stays with your account.

  Account
• get_company_context, set_company_context

  Read or replace the company profile set under Customize. set_company_context is a full replace: read it first.

  Account
• list_companies, get_company, create_company, update_company, delete_company, link_company_to_workspace, unlink_workspace_company

  Client company profiles, each linkable to a workspace so conversations there use that company's context.

  Account
• list_api_keys, create_api_key, revoke_api_key

  Manage sk-isms keys for the model API from your agent. Personal access token only.

  Model API
• get_api_credit_balance, create_api_credit_checkout

  Balance and top-up checkout links. Personal access token only.

  Model API

Auth

Token

pat-isms-... shown once, optional expiry

Where

chat.ismscopilot.com, Settings, Connected apps

Scopes

Per token: account, workspaces (read; workspaces:write to create), documents (list), memories (read, write), company_context:read, company_context:write, conversations (create, send), api_keys:read, api_keys:write, api_credits:read, api_credits:checkout

Revoke

Instantly, from the same screen

Billing

Your chat subscription, every plan including Free. No separate agent plan.

Logging

Every call is logged against the token that made it

Limits

Rate

About 120 requests a minute per token

Conversations

Concurrent conversations capped per account

Chat window

Shared 4-hour window with the chat app. On the cap, create_conversation and send_message return reset_at (plus upgrade_url for solo accounts and organization owners on a personal access token; sign-in connections from Claude or ChatGPT get no upgrade or purchase fields). When the cap response carries fallback_available (solo paid accounts with Advanced Data Protection off, never a team pool), the agent can continue on the same up-to-2x overflow as the web app with overflow_consent, after your go-ahead. Read tools keep working.

Modes

fast (default), think (paid), beyond (paid, 10/UTC day, 50 on Unlimited; agent must set mode, not auto-selected)

Replies are asynchronous

send_message  ->  { "status": "generating", "conversation_id": "conv_..." }
get_reply     ->  { "status": "generating" }        // poll every 2 to 5 seconds
get_reply     ->  { "status": "complete", "reply": "..." }

Poll get_reply until complete or error. Do not open parallel think turns on one conversation.

Not available over MCP

• Agent Tasks (not generally available anywhere as of 2026-09-28)
• Advanced Data Protection toggle (web app only)
• Document download by id (list only)
• Delete operations: destructive actions stay in the app where you can see them
• heyGRC pull request reviews (separate product)

Not the same thing as the API

The ISMS Copilot API gives your code our compliance model: you send prompts, you get completions, you build your own product on top (sk-isms keys, prepaid credits). ISMS Copilot for Agents gives your tools your account: your conversations, workspaces, memories and documents (pat-isms tokens, chat subscription). Different jobs, different keys.

Status: live

Account MCP is live. Create a pat-isms token in chat Settings, Connected apps, then connect your client. Docs: docs.ismscopilot.com/docs/agents. Machine summary: GET /api/public/agents/v1.

Frequently Asked Questions