Headless compliance.
Run by your AI agent.
Connect Strac Comply's MCP server to Claude Code, Codex, Gemini CLI, Grok Build, Cursor or OpenCode. Ask it to upload a policy, file evidence or answer your auditor.
Most days you won’t open our dashboard at all.
How it connects
Run one command
Paste it into your terminal. Cursor and OpenCode take a few lines in a config file instead. Each setup points your agent at
mcp.comply.strac.io.Sign in and pick scopes
Your browser opens. Sign in with your Strac Comply account and choose what the agent may do, like
compliance:readorpolicies:write. Revoke the agent's access any time in Settings.Ask in plain words
The agent reads your live controls, tests, policies and documents, and writes evidence back. Every change goes into the activity log with the agent's name on it.
claude mcp add --transport http --scope user strac-comply \ https://mcp.comply.strac.io/mcp
# Then run /mcp in Claude Code and pick Authenticate.
codex mcp add strac-comply --url \ https://mcp.comply.strac.io/mcp
# Codex opens your browser to sign in.
gemini mcp add --scope user --transport http strac-comply \ https://mcp.comply.strac.io/mcp
# Gemini opens your browser to sign in. If it does not, run /mcp auth strac-comply in a session.
grok mcp add --transport http strac-comply \ https://mcp.comply.strac.io/mcp
# Grok opens your browser to sign in the first time you use it.
~/.cursor/mcp.json
{
"mcpServers": {
"strac-comply": { "url": "https://mcp.comply.strac.io/mcp" }
}
}# Save it, then sign in from Cursor Settings > MCP.
~/.config/opencode/opencode.json
{
"mcp": {
"strac-comply": { "type": "remote", "url": "https://mcp.comply.strac.io/mcp" }
}
}# OpenCode opens your browser to sign in the first time you use it.
Then ask in plain words, for example: How close are we to our SOC 2 audit? The agent answers from your live controls.
Run it before you start Claude Code. Claude Code loads its MCP config at startup. --scope user adds the server to every session, not only this folder.
One command adds the server and opens your browser to sign in. If Codex says the server may or may not require login, run codex mcp login strac-comply.
--scope user adds it to every project. Gemini's default is the current project only. --transport http marks it as a remote server.
Grok signs in the first time you use the server and keeps the tokens in ~/.grok/mcp_credentials.json.
Save it to ~/.cursor/mcp.json, or add the server in Cursor Settings > MCP. Cursor reloads MCP servers when the file changes.
Add it to your global config, ~/.config/opencode/opencode.json. OpenCode signs in to a remote server the first time you use it.
Use a different agent? Other MCP clients that sign in from your machine work too. See the setup in the docs.
Ask in plain words. Your agent does the work.
Every tool below is a real MCP method on mcp.comply.strac.io.
Answer compliance questions
“Where are we on SOC 2 CC6?” Your AI reads your live controls, policies and test evidence. It answers from your own data, not from generic advice.
ask_compliance_question
Read your full compliance state
Controls, policies, documents, audits, test results, employees: the AI can list each one and open its details. It sees only your company's data, and only what your scopes allow.
list_controlslist_policieslist_tests
Write policies and evidence
Your AI drafts policies, uploads new versions and attaches evidence to controls. It can mark a control Not Applicable and write down why. Every change goes into the activity log with the agent's name on it.
upload_policyattach_evidencemark_control_na
Connect your integrations
Your AI gives you a connect link for Google Workspace, AWS or Slack. You approve access in your browser. The AI checks until the integration is live, then the integration starts to collect evidence.
connect_integrationget_connection_status
Switch from another compliance tool
Export your data from Vanta, Drata, Secureframe or another compliance tool, and point your AI at the folder. The installed
strac-importplaybook moves your policies, vendors, risks and evidence in one run, even historic test runs. It is safe to run again: a second run adds no duplicates.import_vendorsimport_risksimport_test_runs
Run and triage automated tests
After a fix, your AI re-runs the test that failed and follows the run to the end. It can also propose a waiver. The AI drafts the reason, and a person approves it in the app.
rerun_testget_test_executionacknowledge_test
Manage vendor risk
Your AI runs the rule-based vendor risk assessment on one vendor or your whole list. It records completed security reviews and files a vendor's SOC 2 report or DPA on the vendor's record. Strac Comply labels each action as recorded by the agent.
run_vendor_risk_assessmentsrecord_vendor_security_reviewattach_vendor_document
Reply to your auditor
Your AI lists open evidence requests and drafts a reply from binder evidence or a new upload. It sends the reply in a separate step, so no reply reaches your auditor by accident.
list_audit_requestssubmit_audit_request_response
Works with the agent you already use.
Each agent connects with one command or one config entry, and Claude Desktop with a custom connector. Then you sign in from your browser.
- Claude Code
- Codex
- Gemini CLI
- Grok Build
- Cursor
- OpenCode
- Claude Desktop
Let your AI agent run your compliance.
Strac Comply covers SOC 2, ISO 27001, PCI DSS, HIPAA, NIST CSF and more. Your agent does the compliance work while you build.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing