Skip to content

Strac Comply developer platform

Read your live compliance status and send evidence back from code. You get two ways in: a REST API you script from CI or any HTTP client, and an MCP server your AI agent connects to. Both use scoped tokens you can revoke, and every write lands in an append-only audit log with who made it.

Two ways in

REST API

https://comply.strac.io/api/v1. Read your controls, policies, documents, audits, tests and people, and make the key writes, like approving a policy or publishing a document. Sign requests with a Personal Access Token.

MCP server

https://mcp.comply.strac.io/mcp. Connect Claude Code, Codex, Gemini CLI, Grok Build, Cursor or OpenCode. You sign in once in your browser (OAuth 2.1 + PKCE), and the agent only sees the tools your scopes allow.

Choose your authentication

There are two token types. Both are scoped and you can revoke either one. Use a Personal Access Token (strac_pat_*) when you script the REST API from CI. Use OAuth 2.1 + PKCE (mcp_at_*) for MCP clients, which run the sign-in for you. The full walkthrough is in Authentication.

Quickstart

Create a PAT (see Authentication), then make your first call. GET /frameworks needs only the compliance:read scope:

bashGET /api/v1/frameworks
curl 'https://comply.strac.io/api/v1/frameworks' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response:

json
{  "success": true,  "framework": "all",  "controls": [    {      "id": "soc2-cc6.1",      "frameworkId": "soc2",      "controlId": "CC6.1",      "title": "Logical access controls",      "category": "Logical & Physical Access",      "riskLevel": "high"    }  ]}

Scopes

Every token carries scopes. Ask for only what your script or agent needs. Write scopes need an owner or admin to grant them.

compliance:read
policies:read
policies:write
policies:approve
documents:read
documents:write
tests:write
personnel:read
audits:read
evidence:write
chat:ask
vendors:read
vendors:write
risks:read
risks:write
audit-requests:write

What each scope allows is listed on the REST reference and MCP pages.

How your data stays safe

Safe to build against

The server decides who made each request from the token, so no one can write under someone else's name. A token only reaches its own company. A request for another company's data is refused (403 on REST, not_found on MCP), never served. Every write is recorded in an append-only audit log. Evidence you attach to an audit is pinned to the exact version you attached.

Where to go next