Track delays
List a client's remediation items that are past their due date, with their owner.
MCP server · Included in every plan
Run your GRC engagements from your AI assistant, while staying in control.
Claude, ChatGPT or Copilot read and update your audits, controls, risks and tasks, with your permissions. Publishing an audit remains subject to your approval.
At a glance
MCP (Model Context Protocol) is an open protocol that lets an AI assistant use an application's tools. The CompliKey MCP server:
- acts with your account permissions
- requires your approval before publishing an audit
- records its actions in a dedicated log
- is included in every plan, Freemium included
Who it is for
Designed for consultants who follow several clients.
GRC consultants and virtual CISOs first, in-house compliance teams next: you ask the question, the assistant fetches the answer from CompliKey.
Turn an audit into an action plan
Create the tasks arising from the findings of a published audit, linked to the remediation items.
Prepare a review
Gather the compliance summary and the documents due for review before a committee or management review.
Take stock
Check a scope's compliance level, framework by framework.
What the assistant can read and do
Always within the limits of your permissions and your plan.
| Area | Read | Act | Status |
|---|---|---|---|
| Audits | Audits, answers and findings | Create an audit, choose the controls, answer the questions, publish after your approval | Available |
| Controls | Controls, levels and history | Create and edit a control, update its level, its evidence and linked tasks | Available |
| Frameworks and requirements | Frameworks and requirements | Create an internal framework and its requirements | Available |
| Risks | Risk register and analyses | Create, edit and approve a risk | Available |
| Tasks | Tasks, statuses and due dates | Create and edit a task, change its status, its checklist, comment on it | Available |
| Remediation | Published findings to follow up | Update their follow-up | Available |
| Review documents | Search by name, review dates | Create a review document, record a review | Available |
| Compliance summary | Level, score per framework, task coverage | Read only | Available |
Control and security
The assistant proposes, you decide.
Human approval before publishing
Publishing an audit cannot be undone: the server enforces a preview, then your explicit confirmation. The assistant cannot publish on its own.
Your permissions, nothing more
The assistant acts with your account permissions: same scopes, same role. What you cannot see or change, it cannot either.
OAuth2 connection
You authorise access from your CompliKey account: no password is given to the AI client.
Actions recorded
Actions carried out through the MCP server are recorded in a dedicated log.
No deletion
The server deletes nothing, except items of a draft audit that you explicitly remove.
Your files are not read
Evidence is stored as links: the content of your documents is never read. CompliKey holds no passwords or technical secrets.
About your data. CompliKey's hosting in France does not cover the data your AI assistant reads: it passes through its provider's service, under that provider's own terms. Choose a client and a plan suited to the sensitivity of your data.
Get started in three steps
-
1
Add the connector
In your AI client, add an MCP connector with the address:
https://app.complikey.com/mcp -
2
Connect your account
Sign in with your CompliKey account and authorise access. No key to generate.
-
3
Ask your first question
For example: “What is the compliance level of my main scope?”
No account yet? Create one free: the MCP server is included in Freemium.
-
You
Which remediation items are overdue at Demo Client?
-
Assistant
On the Head office scope, 2 remediation items are past their due date: “Privileged account review” (minor nonconformity) and “Offline backups” (major nonconformity).
-
You
Create a task for each, assigned to Camille, due at the end of November.
-
Assistant
I will create 2 tasks linked to these remediation items, owner Camille, due on 30 November. Shall I create them?
-
You
Yes.
-
Assistant
Done: 2 tasks created, Camille has been notified.
What the assistant does not do
- It replaces neither the auditor nor your decision: it prepares, you approve.
- It does not make an organisation compliant: there is no automatic compliance.
- It can make mistakes: review what it proposes before confirming a change.
- It goes beyond neither your permissions nor the limits of your plan.
Questions about the MCP server
Is it secure?
The connection uses OAuth2 from your CompliKey account, with no password given to the AI client. The assistant acts with your permissions, its actions are recorded in a dedicated log, and publishing an audit requires your approval.
Where does my data go?
CompliKey's hosting in France does not cover the data your AI assistant reads: it passes through its provider's service, under that provider's own terms. Choose a client and a plan suited to the sensitivity of your data.
Which plans include the MCP server?
All of them, Freemium included. The server respects the limits of your plan (scopes, users, controls), with no call quota.
Which AI assistants are compatible?
Claude, ChatGPT and Copilot have been tested. Other clients compatible with MCP and OAuth2 may work, without having been tested.
Can the assistant publish an audit on its own?
No. The server enforces a preview, then your explicit confirmation, before any publication.
How do I cut off access?
Remove the CompliKey connector in your AI client: it then has no access to your data.
See the MCP server on a real engagement
A 45-minute demo with the founder, on your framework and your scopes.