ISMS Copilot
How to

Connect ISMS Copilot to Cursor

Talk to a specialist compliance AI from the harness you already use. Connected over MCP, Cursor can read your ISMS Copilot workspaces, document metadata, and memories, and hold real compliance conversations, acting as you within the scopes you grant. Usage rides your ISMS Copilot chat subscription; there is no separate agent plan.

Create a token

Set up in three steps

  1. 1Sign up free at chat.ismscopilot.com (a free tier exists, no card required), then create a token: Settings, Connected apps, Create token. Grant the narrowest scopes for the job and copy the pat-isms secret immediately; it is shown once.
  2. 2Add the server to your mcp.json: the global file at ~/.cursor/mcp.json to make ISMS Copilot available in every project, or the project file at .cursor/mcp.json for one project. Use the config below.
  3. 3Open Customize in Cursor's sidebar, find ismscopilot, enable it, and ask in plain English, for example: list my ISMS Copilot workspaces.

The mcp.json entry

{
  "mcpServers": {
    "ismscopilot": {
      "url": "https://account.ismscopilot.com/v1/account/mcp",
      "headers": {
          "Authorization": "Bearer ${env:ISMSCOPILOT_TOKEN}"
      }
    }
  }
}

Set ISMSCOPILOT_TOKEN in your shell profile (for example: export ISMSCOPILOT_TOKEN="pat-isms-..."). Cursor resolves ${env:ISMSCOPILOT_TOKEN} inside the headers field, so the token itself never lands in the file. If you prefer to paste the token literally, put the entry in the global file instead; see the next section.

Pick the right mcp.json

Cursor reads MCP servers from two files: ~/.cursor/mcp.json in your home directory (global, applies to every project) and .cursor/mcp.json inside a project root (project scope, which you can share through git).

  • Put the server in the global file when you work across projects, or whenever the config would carry a secret.
  • A project-level .cursor/mcp.json can be committed to share the server configuration with your team. Never put a raw pat-isms token in it. Use the environment-variable form shown above (Cursor supports interpolation in the headers field), and each developer points the variable at their own token.
  • If a token ever lands in a committed file, treat it as compromised: revoke it in ISMS Copilot (Settings, Connected apps) and rotate the variable in your shell profile.

What it costs

Compliance answers you can trust, inside Claude Code, Cursor or Codex, without burning your Claude or ChatGPT plan.

Account MCP, the surface this page connects to, is covered by your ISMS Copilot chat subscription: a fixed cost with no per-token billing. The metered option is the separate Model API (sk-isms keys), a different credential plane. Its rates, with sources and dates, live in the cost comparator on the GRC engineers page. See the comparator.

Secure by design

Access from outside your account happens only through a token you create yourself, and you stay in control of it.

  • A token acts as you and is limited to the scopes you grant when you create it. Grant the minimum.
  • It is covered by your subscription, with no separate billing to set up, and it can be revoked anytime in Settings, Connected apps.
  • Tokens do not unlock the Model API (sk-isms keys) or Embed partner billing. The credential planes are separate.
  • Toggling Advanced Data Protection is not available over MCP. Manage it in the web app.
  • The in-app Agent Tasks surface is separate from Account MCP and is not available through it (as of 2026-09-03, flags off in production).

Facts and dates

  • Cursor behavior as documented at cursor.com/docs/mcp, fetched 2026-09-16: MCP servers are configured in mcp.json (project or global), remote servers connect over Streamable HTTP with a url and headers, environment interpolation is supported in the headers field, and servers are managed from the Customize page.
  • ISMS Copilot endpoint, token steps, scopes, and limits verified against the machine connect feed (GET /api/public/connect/v1) and the product truth feed (GET /api/public/agents/v1), both fetched 2026-09-16.

Related

Create a token and connect

Open Settings, Connected apps in ISMS Copilot, create a token, and paste the config above into Cursor.

Create a token