ISMS Copilot

AI가 호출하는 컴플라이언스 전문가: ISO 27001, SOC 2, GDPR, NIS 2, DORA 등.

ismscopilot.com에서 보기

호스팅형 MCP 서버

npx add-mcp 'https://account.ismscopilot.com/v1/account/mcp'

Claude Code, Codex, Cursor 등에 설치됩니다

문서

Canonical: https://www.ismscopilot.com/mcp

ISMS Copilot MCP server

The compliance specialist your AI calls. Add ISMS Copilot to Claude, ChatGPT, Cursor or Codex. Your AI does the work and asks ISMS Copilot when the framework has to be right. For agents that need a compliance specialist.

Official remote MCP server for ISMS Copilot (ismscopilot.com, made by Better ISMS). Not Microsoft Copilot or GitHub Copilot. Human page: https://www.ismscopilot.com/mcp

When to call

You (the agent) stay the harness. Call ISMS Copilot when a subtask needs a framework answer that has to be right:

  • Answer a framework question, with the clause: Your AI asks which control covers the topic. The answer comes back with the clause number, not a guess from memory. You check that number before you sign.
  • Check a document against a control: Your AI reads the policy or procedure you already have and sends a short excerpt. Ask what is missing against the control you name. You sign the answer. The file stays where it lives.
  • Find the record differences an auditor would raise: Your AI compares two files that should agree, such as the SoA and the risk register, and lists every difference. ISMS Copilot says which differences an auditor would raise and how to fix them. You fix the source files.

Frameworks: ISO 27001, ISO 27701, ISO 42001, SOC 2, GDPR, NIS 2, DORA, EU AI Act, Cyber Resilience Act, NIST SP 800-171 / CMMC, HIPAA, PCI DSS and more. Keep code, git, files and general questions local.

How to call

  • Endpoint: https://account.ismscopilot.com/v1/account/mcp
  • Transport: Streamable HTTP (remote). Nothing to install.
  • Auth, sign-in (OAuth): claude.ai, Claude Desktop, Claude Code and ChatGPT custom MCP apps. Add the URL with no header; the human signs in to ISMS Copilot and clicks Approve. You cannot do this step for them.
  • Auth, token: Cursor, Codex, other clients, CI. Header Authorization: Bearer pat-isms-.... The human creates the token at chat.ismscopilot.com, Settings, Connected apps (Agent delegation preset). Keep it in an environment variable, never in a committed file.
  • Official setup prompt (follow it to connect for your user): https://docs.ismscopilot.com/agent-setup/prompt.md

Claude Code, sign-in:

claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp

Then /mcp in a session, pick ismscopilot, sign in, Approve.

Codex (~/.codex/config.toml), token:

[mcp_servers.ismscopilot]
url = "https://account.ismscopilot.com/v1/account/mcp"
bearer_token_env_var = "ISMS_COPILOT_TOKEN"

Cursor (~/.cursor/mcp.json), token:

{
  "mcpServers": {
    "ismscopilot": {
      "url": "https://account.ismscopilot.com/v1/account/mcp",
      "headers": {
        "Authorization": "Bearer ${env:ISMS_COPILOT_TOKEN}"
      }
    }
  }
}

Calling pattern: create_conversation once per deliverable, then send_message on the same conversation_id for follow-ups. If a call returns status: "generating", poll get_reply every 2 to 5 seconds until complete. Pass answer_format: "brief" or "decision" for a compact reply.

Tools over sign-in (up to 19, filtered by the scopes the user approved): create_conversation, send_message, get_reply; get_account_info, list_workspaces, create_workspace; list_documents; list_memories, create_memory, update_memory; get_company_context, set_company_context; list_companies, get_company, create_company, update_company, delete_company, link_company_to_workspace, unlink_workspace_company. A token sees the same tools its scopes allow, and with the Model API scopes also: list_api_keys, create_api_key, revoke_api_key; get_api_credit_balance, create_api_credit_checkout. A token with the conversations scope also sees list_assistants: built-in assistants for the Cyber Resilience Act, DORA, EU AI Act, NIS 2, privacy management and AI management, plus the GRC squad by job (by_job): Questionnaire responder, Audit prep, Implementation lead and Incident lead. Pass the id as assistant on create_conversation or send_message; omit it for the general specialist.

Gotchas

  • Default to mode: "fast". think and beyond need a paid plan and run only when the human asks; beyond is minutes-scale and capped per day.
  • Do not send a new message while the previous turn is still generating; the server rejects it.
  • Usage shares the user's 4-hour chat window. At the cap the reply carries reset_at; tell the human, do not retry in a loop.
  • set_company_context is a full replace: read with get_company_context first, and call it only when the user asks to update their profile.
  • Sign-in connections cannot create API keys or buy credits. Writes are labeled in the app as made by the OAuth app.
  • ISMS Copilot works from what you send (up to 100,000 characters per message), plus the user's company context, memories and any files already pinned to the workspace in the web app. Over MCP you cannot upload or read files: list_documents returns metadata of documents uploaded in the web app, not their content. There is no Vanta, Drata or other GRC platform connector. You read the files and records; send ISMS Copilot what needs judging.
  • Check any fact ISMS Copilot states about the user's own records (a version, a date, a status) against the source file before relying on it.
  • A token acts as the user. Never commit it or paste it into an issue.
  • Do not invent another URL, npm package or API key. There is no local server.

Guardrails

  • Sourced answers: verify only what ISMS Copilot marks as unconfirmed, against the official text, and say what you verified.
  • Drafts only. A human reviews, signs and publishes policies and evidence.
  • No certification guarantees: ISMS Copilot does not certify anyone or replace the auditor.

Price

Free plan: $0, no card, fast mode, 10 messages per 4 hours. Paid plans start at $24 a month (Plus). Agent calls count against the user's own ISMS Copilot plan; there is no separate agent plan. All plans: https://www.ismscopilot.com/pricing

Example (2026-10-09, fast mode, unedited reply)

  • You, to your AI: Do we need to keep a list of our IT suppliers for DORA?
  • Your AI, to ISMS Copilot: Does DORA require a financial entity to keep a register of its ICT third-party contracts? Answer yes or no and name the exact article and paragraph, in one or two sentences.
  • ISMS Copilot: Yes. DORA Art. 28(3) requires financial entities to maintain a register of information on all their contractual arrangements on ICT services (with standard templates mandated via Art. 28(9)).

Per-AI pages

Setup and examples for one AI tool each:

Machine-readable