Headless Compliance · MCP

Headless compliance.
Run by your AI agent.

Strac Comply's MCP server. Connect Claude Code, Cursor, or any MCP-aware client — and let your AI agent build and maintain your SOC 2 binder. No dashboard required.

Book a DemoRead the docs
bashrun before starting Claude Code
claude mcp add --transport http --scope user strac-comply \  https://mcp.comply.strac.io/mcp

Run this before you launch Claude Code (MCP config loads at startup). Then, in a session, run /mcp → Authenticate once. --scope user keeps it available in every session, not just the current folder.

How it connects

Three steps from zero to your AI agent writing evidence into your binder.

  1. 01

    Run the connect command

    Pick your client tab above and paste the snippet into Claude Code, Claude Desktop, Cursor, or any MCP-aware client. The client opens your browser to mcp.comply.strac.io for consent.

  2. 02

    Sign in & pick scopes

    Sign in with the same account you use for the web app. Choose which scopes the AI gets: compliance:read, policies:write, documents:write, and more. Scopes are revocable from Settings.

  3. 03

    Your AI agent does the work

    The agent reads your live compliance state — controls, policies, documents, test results, employees, audits — and writes evidence back to your binder. Every action lands in an append-only audit log with the AI's identity stamped on it.

What your AI agent can do

Every tool below is a real MCP method on mcp.comply.strac.io.

  • Answer compliance questions

    tool

    “Where are we on SOC 2 CC6?” — your AI reads live controls, policies, and test evidence, then answers grounded in your real posture, not generic advice.

    ask_compliance_question

  • Read your full compliance state

    tool

    Controls, policies, documents, audits, test results, employees — the AI can list and drill into every surface. Filtered by scope; partitioned by your tenant.

    list_controls · list_policies · list_tests

  • Write policies and evidence

    tool

    Draft policies, upload new versions, attach evidence to controls, mark controls Not Applicable with justifications. Every write emits an audit-log row attributing the change to the AI.

    upload_policy · attach_evidence · mark_control_na

  • Connect your integrations

    tool

    Hand the AI a connect-button for Google Workspace, AWS, Slack, or GitHub. The customer authorizes in the browser; the AI polls until the integration is live and starts pulling evidence.

    connect_integration · get_connection_status

Works with your AI client

Standard MCP transport. Drop in your client's config and reload.

Claude CodeClaude DesktopCursorContinueClineWindsurf

Ready to ship faster?

Built for SOC 2, ISO 27001, NIST CSF, GDPR, and HIPAA. Compliance that runs while you build.

Book a DemoRead the docs →