English Français العربية

ISMS Copilot

Official registry Security

The compliance specialist your AI calls: ISO 27001, SOC 2, GDPR, NIS 2, DORA and more.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http isms-copilot 'https://account.ismscopilot.com/v1/account/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "isms-copilot": {
            "type": "http",
            "url": "https://account.ismscopilot.com/v1/account/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. ISMS Copilot
  2. What this plugin contains
  3. Install
  4. Links
  5. Package layout (maintainers)
  6. License

ISMS Copilot

The compliance specialist your AI calls.

ISMS Copilot is a governance, risk and compliance (GRC) assistant. Connect your ISMS Copilot account and Claude can hand it the compliance part of your work: framework interpretation, policy drafting, control mapping, gap analysis, Statement of Applicability justifications, risk register entries and audit preparation for ISO 27001, ISO 27701, ISO 42001, SOC 2, GDPR, NIS 2, DORA, the EU AI Act, the Cyber Resilience Act, NIST SP 800-171 and CMMC, HIPAA and PCI DSS.

What the connector does:

  • Starts and continues conversations with the ISMS Copilot specialist, one conversation per deliverable, saved to your ISMS Copilot account.
  • Reads your plan name, workspaces, document names and processing status, memories, company profile and client companies, so answers fit your organization. When you ask the specialist in a workspace, it may use that workspace's processed documents as context for its answer.
  • Creates workspaces, adds or updates memories and updates your company profile when you ask. If you advise several organizations, it can also create, update, link and delete client companies (one profile per client); deleting a company unlinks its workspaces and never deletes workspace data.

What it does not do: it does not read Claude's chat history or files you upload to Claude, no tool returns a stored file as such, and it has no payment, checkout or API key tools.

Sign in with your ISMS Copilot account; new users can create one on the sign-in page. ISMS Copilot uses AI. Answers are general compliance information, not legal advice: have a qualified professional review legal or regulatory interpretations before you rely on or share them. ISMS Copilot is made by Better ISMS and is not affiliated with Microsoft or GitHub.

What this plugin contains

  • One remote MCP server, ismscopilot, at https://account.ismscopilot.com/v1/account/mcp (Streamable HTTP). The first time a tool runs, your client opens the ISMS Copilot sign-in and consent page (OAuth 2.1). The plugin stores no credentials and asks for no API key.
  • One skill, get-started, that tells the assistant what to hand to the specialist and what stays on your machine.

It has no hooks, scripts, commands or local code. It sends data only to the ISMS Copilot server above: whatever the assistant puts into a tool call (questions for the specialist, memories, company context, workspace and document requests, including any excerpt it chooses to quote).

Install

Claude Code
claude plugin marketplace add better-isms/ismscopilot-plugin
claude plugin install ismscopilot@ismscopilot

Then run /mcp, pick ismscopilot and sign in. Or add the server on its own:

claude mcp add --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp
Gemini CLI
gemini extensions install https://github.com/better-isms/ismscopilot-plugin

Restart Gemini CLI, then run /mcp auth ismscopilot to sign in.

Other MCP clients

Setup guide: https://docs.ismscopilot.com/docs/agents/connect-any-mcp-client

Package layout (maintainers)

  • .claude-plugin/plugin.json: Claude Code manifest (it also carries the extensions.com.openai block, which Claude Code ignores).
  • .cursor-plugin/plugin.json: Cursor manifest (cursor.directory); points Cursor at .mcp.json.
  • .claude-plugin/marketplace.json: one-plugin Claude Code marketplace, so the repo installs with claude plugin marketplace add.
  • .mcp.json: the MCP server entry for Claude Code (type http).
  • gemini-extension.json and GEMINI.md: Gemini CLI extension manifest and its context file.
  • plugin.json and mcp.json: Agent Plugins manifest and server entry for the ChatGPT and Codex plugins directory.
  • skills/get-started/SKILL.md: onboarding skill.
  • assets/logo.png: listing icon.

Releases use merge-commit PRs to main. Raise version in the manifests with every release.

License

MIT. See LICENSE.

Frequently asked questions

What is ISMS Copilot?

The compliance specialist your AI calls: ISO 27001, SOC 2, GDPR, NIS 2, DORA and more.

How do I install ISMS Copilot?

It runs as a remote server. In Claude Code: claude mcp add --transport http isms-copilot 'https://account.ismscopilot.com/v1/account/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does ISMS Copilot need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is ISMS Copilot open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains ISMS Copilot?

It is published by better-isms. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.