A compliance specialist your agent can call.

Works with

• Claude Code

  The one-line install above. Restart, then /mcp to verify.

  One line
• Cursor

  HTTP MCP server entry: the URL plus the Authorization header.

  Config
• Codex

  Same URL, same Bearer header.

  Config
• Hermes and any HTTP MCP client

  Streamable HTTP transport, Bearer token.

  Config
• ChatGPT connectors

  OAuth-only clients cannot use personal access tokens yet.

  Not yet

Any other client

{
  "mcpServers": {
    "ismscopilot": {
      "url": "https://account.ismscopilot.com/v1/account/mcp",
      "headers": { "Authorization": "Bearer pat-isms-..." }
    }
  }
}

The same endpoint and header in the JSON shape most clients accept.

Tools

Sixteen tools on the live server, grouped by plane. Each needs the matching scope on the token.

• create_conversation, send_message, get_reply

  Ask the specialist. Fast by default, think on paid plans.

  Conversations
• get_account_info, list_workspaces

  Who you are, which client workspaces exist.

  Account
• list_documents

  Generated documents, metadata only. No download by id.

  Account
• list_memories, create_memory, update_memory

  What your agent learns stays with your account.

  Account
• get_company_context, set_company_context

  The context every answer is grounded in.

  Account
• list_api_keys, create_api_key, revoke_api_key

  Manage sk-isms keys for the model API from your agent.

  Model API
• get_api_credit_balance, create_api_credit_checkout

  Balance and top-up checkout links.

  Model API

Auth

Token

pat-isms-... shown once, optional expiry

Where

chat.ismscopilot.com, Settings, Connected apps

Scopes

Per token: account, workspaces, documents (list), memories (read, write), conversations (create, send), api_keys:read, api_keys:write, api_credits:read, api_credits:checkout

Revoke

Instantly, from the same screen

Billing

Your chat subscription. No separate agent plan.

Logging

Every call is logged against the token that made it

Limits

Rate

About 120 requests a minute per token

Conversations

Concurrent conversations capped per account

Chat window

Shared 4-hour window with the chat app. On the cap, create_conversation and send_message return reset_at and upgrade_url; read tools keep working.

Modes

fast (default), think (paid), beyond (paid, 10/UTC day; agent must set mode, not auto-selected)

Replies are asynchronous

send_message  ->  { "status": "generating", "conversation_id": "conv_..." }
get_reply     ->  { "status": "generating" }        // poll every 2 to 5 seconds
get_reply     ->  { "status": "complete", "reply": "..." }

Poll get_reply until complete or error. Do not open parallel think turns on one conversation.

Not available over MCP

• Agent Tasks (not generally available anywhere as of 2026-09-03)
• Advanced Data Protection toggle (web app only)
• Document download by id (list only)
• Delete operations: destructive actions stay in the app where you can see them
• heyGRC pull request reviews (separate product)

Not the same thing as the API

The ISMS Copilot API gives your code our compliance model: you send prompts, you get completions, you build your own product on top (sk-isms keys, prepaid credits). ISMS Copilot for Agents gives your tools your account: your conversations, workspaces, memories and documents (pat-isms tokens, chat subscription). Different jobs, different keys.

Status: live

Account MCP is live. Create a pat-isms token in chat Settings, Connected apps, then connect your client. Docs: docs.ismscopilot.com/docs/agents. Machine summary: GET /api/public/agents/v1.

Frequently Asked Questions