Skip to content

Strac Comply developer platform

Read your live compliance posture and write evidence back to the binder from code. Two surfaces, one tenant: a REST API you script from CI or any HTTP client, and an MCP server an AI agent connects to. Both are scoped, revocable, and every write is attributed in an append-only audit log.

Two surfaces

REST API

https://comply.strac.io/api/v1. Script reads on every surface plus the lifecycle-critical writes. Authenticate with a Personal Access Token.

MCP server

https://mcp.comply.strac.io/mcp. Connect Claude Code, Claude Desktop, Cursor, or any MCP client. OAuth 2.1 + PKCE, scoped tools.

Choose your authentication

Two bearer formats, both scoped and revocable. Use a Personal Access Token (strac_pat_*) for the REST API from CI or a script. Use OAuth 2.1 + PKCE (mcp_at_*) for MCP clients. They run the flow for you. Full walkthrough in Authentication.

Quickstart

Mint a PAT (see Authentication), then make your first call. GET /frameworks needs only a compliance:read bearer:

bashGET /api/v1/frameworks
curl 'https://comply.strac.io/api/v1/frameworks' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response:

json
{  "success": true,  "framework": "all",  "controls": [    {      "id": "soc2-cc6.1",      "frameworkId": "soc2",      "controlId": "CC6.1",      "title": "Logical access controls",      "category": "Logical & Physical Access",      "riskLevel": "high"    }  ]}

Scopes

Every bearer carries least-privilege scopes. Request only what the integration needs.

compliance:read
policies:read
policies:write
policies:approve
documents:read
documents:write
tests:write
personnel:read
audits:read
evidence:write
chat:ask
vendors:read
vendors:write
risks:read
risks:write
audit-requests:write

Each scope's exact grants are documented inline on the REST reference and MCP pages.

Platform guarantees

Safe to build against

Identity is server-derived (you cannot spoof the actor on a write). Tenant boundaries are structural — cross-tenant requests return not_found, never a leak. Every write fans out to an append-only audit log. Evidence attached to an audit is version-pinned at attach time.

Where to go next