The Complyance MCP server lets you connect an AI assistant, such as Claude or ChatGPT, to your Complyance account. Once connected, you can ask your assistant to review failing controls, summarize policies, or add vendors and risks without leaving the conversation. The assistant uses your existing permissions, so it can only see and change what you can in the Complyance app.
What is MCP? MCP (Model Context Protocol) is an open standard that lets AI assistants work with connected applications.
What you can do with the MCP Server
Once connected, your assistant can help with everyday compliance work:
- Audit preparation: Find failing controls in a program and review the evidence linked to each one.
- Policy review: Find a policy and summarize its current version.
- Evidence management: Create evidence, add new versions, and link evidence to controls.
- Risk management: Review your risk register and create or update risks.
- Vendor management: Add vendors, track reviews and approvals, and retire or reinstate vendors.
- Search: Find controls, evidence, policies, risks, tasks, and vendors by keyword.
The capabilities available to you depend on the modules enabled in your organization and your role permissions.
Before you start
Before you connect, check that:
Your organization has API access. If you don't see MCP in your settings, contact Complyance Support.
- MCP turned on for your organization by an administrator, in Organization settings > MCP.
- Role permissions: To connect and read, your role needs Use AI assistants with read access. To create or change records, it also needs Use AI assistants with write access.
- A supported assistant. See Connect your assistant.
At a glance
| Server URL (Europe) | https://api.eu.complyance.com/mcp |
| Server URL (United States) | https://api.complyance.us/mcp |
| Authentication | Complyance sign-in (OAuth) |
| Default access | Read only. Read and write when your role allows it and you approve it. |
| Tested assistants | Claude (web and apps), ChatGPT, Codex (CLI, app, IDE) |
| Rate limit | 1,000 tool calls per hour per connection |
Connecting your AI assistant
Connecting takes three steps: find your MCP URL, add Complyance to your assistant, then sign in and approve access.
-
Find your MCP URL
Use the URL for the region where your Complyance account is hosted. The Complyance app also shows your URL under Account settings > MCP.
Region MCP URL Europe https://api.eu.complyance.com/mcp United States https://api.complyance.us/mcp Authentication uses your Complyance sign-in (OAuth).
-
Add Complyance to your assistant
Follow the steps for your assistant:
- Claude (web and apps): in Settings > Connectors, add a custom connector named Complyance with your MCP URL. Claude's guide
- ChatGPT: add a custom MCP server named Complyance with your MCP URL and OAuth authentication. Leave client ID and secret blank. Your workspace must allow custom servers. Then install it and select Complyance in a new chat. OpenAI's guide
- Codex: run codex mcp add complyance --url <your MCP URL>, then codex mcp login complyance. In the Codex app or IDE, add the URL in MCP settings. OpenAI's guide
-
Other MCP clients: clients that support OAuth Client ID Metadata Documents (CIMD) can use the same URL. Dynamic client registration is not supported. Complyance has not tested them, and your organization's client restrictions may block them.
-
Sign in and approve access
When you connect, a browser window opens. Sign in to Complyance, and the approval page will show the account you're signed in as and the assistant requesting access.
- Choose one organization. Each connection covers one organization. To work in another organization, connect again and choose it.
- Choose the access level. Read only is the default. Read and write is available if your role allows it. The assistant can never go beyond the access level you approve.
-
Click Approve. You'll return to your assistant, which can now work in that organization.
Tip: Approval requests expire after one hour and only work in the browser that started them. If your request has expired, start the connection again from your assistant.
Each person on your team connects with their own account, so every change is recorded under the person who approved the connection.
Example prompts to try
Ask for an outcome in plain language. Name the program, record, or person you mean, and name people by email.
- Show me the failing controls in our SOC 2 program and the evidence linked to each of them.
- Find our access control policy and summarize its current version.
- Find everything related to encryption at rest.
- Create a risk called 'Unreviewed vendor access' in the Operational category, with high inherent likelihood and medium inherent impact, owned by jane@example.com.
- Add Acme Analytics as a vendor, with security@acme-analytics.com as the contact, an annual review schedule, and jane@example.com as the owner.
Creating or changing records requires Read and Edit access. Your assistant may ask you to confirm before it makes a change.
Security and privacy
The MCP server is designed so your assistant works within the same boundaries you do in Complyance.
- Your identity and permissions. The assistant signs in as you through OAuth. It can read and change only what you can in the Complyance app.
- One organization, capped access. Each connection is bound to one organization and approved as Read only or Read and write.
- Administrator controls. Administrators turn MCP on or off and can limit which assistants connect, under Organization settings > MCP > Settings. They grant the MCP permissions through roles.
- Data sent to your AI provider. Data the assistant reads is sent to your AI provider, such as Anthropic or OpenAI, and handled under that provider's terms.
- Audit trail. Changes appear in each record's History under your name, with the assistant as the source, for example via Claude.
Important: Data your assistant reads from Complyance is sent to your AI provider, such as Anthropic or OpenAI, and is handled under that provider's terms and privacy settings. Customer platform data in Complyance remains governed by your organization's agreement with Complyance. For more information, see the Complyance privacy notice.
Disconnecting an Assistant
You can disconnect an assistant at any time.
- In Complyance, go to Account settings > MCP.
- Find the assistant and organization you want to remove.
- Click Disconnect.
This ends the connection on all of your devices. To use the assistant with Complyance again, reconnect and approve access.
Troubleshooting
| Problem | What to do |
|---|---|
| MCP is not in your settings | MCP is not available to your organization yet. Contact Complyance Support. |
| Sign-in fails, or your organization is not listed | Check that you used the MCP URL for your region, shown under Account settings > MCP. |
| "You do not have access to an organization that allows this connection" | API access or MCP is off for your organization, your role lacks Use AI assistants with read access, or client restrictions block the assistant. Ask an administrator, or use Switch account if you signed in with the wrong account. |
| The assistant is blocked by client restrictions | An administrator must allow it under Organization settings > MCP > Settings. Then reload the approval page. |
| The request is no longer available | Approval requests expire after an hour and work only in the browser that started them. Connect again from the assistant. |
| The assistant cannot create or change records | Reconnect and approve Read and write, or ask an administrator for Use AI assistants with write access. The module must also be on in your organization. |
| The assistant asks you to sign in again | The approval expired or was disconnected, or MCP was turned off. Reconnect and approve access. |
| A change failed with an unclear outcome | Check the record in Complyance before asking again. Changes are not retried automatically. |
| The assistant reports a rate limit | The connection reached 1,000 tool calls in an hour. Wait and try again. |
| A request returns no results | Check that the module is on in your organization and that your role can see those records. |
Errors returned to the assistant include a request_id, and the approval page may show a Reference. Include it when you contact support.
FAQ
Do I need to be an administrator?
No. Any user whose role has Use AI assistants with read access can connect, once an administrator has turned MCP on.
Can my whole team use it?
Yes. Each person connects with their own account, so changes are attributed to the right person and each connection can be removed individually.
Can I use it with more than one organization?
Yes. Each connection covers one organization. Connect again and choose another organization. Some assistants keep one connection per URL, so connecting again switches organizations instead of adding one.
Further reading
Complyance customers can read detailed guides in the Complyance API documentation, signing in with their Complyance account: Europe or United States.
- Overview: data handling, rate limits, and History.
- Setup: permissions, organization settings, connections, and the full troubleshooting list.
- Tools: every operation by module, more examples, and error codes.
Support
If you have any further questions or need assistance, please don't hesitate to reach out to our implementation or support team!