EquanimGRC exposes a first-class agentic interface. Connect Claude, or any tool that speaks the Model Context Protocol, directly to your compliance workspace. Agents can read your posture, collect evidence from your systems, and keep controls current — all on access rules your team defines.
Architecture
The agentic layer is a stateless TypeScript MCP edge that sits between your MCP client and the EquanimGRC API. It acts as an OAuth 2.1 Resource Server: every request carries a token issued by your organization's self-hosted Authentik instance, which the edge validates before forwarding to the Rails API. Rails remains the security authority — authorization decisions, per-tenant row-level isolation, and the complete audit trail all live there. The MCP edge adds no durable state of its own.
Transport is Streamable HTTP, the current MCP standard. Tokens are scoped to the minimum permissions required for each client's role. Human users consent in their browser via a standard OAuth 2.1 authorization flow; machine agents use client credentials.
Start here
- Connect via MCP — how to point your MCP client at EquanimGRC and authenticate.
- Tools & scopes — the full list of tools, what each one does, and which scope it requires.
- Agents & evidence — how machine agents submit and map evidence automatically.
Early access
The MCP server is available to early-access customers. Request access and we'll reach out when it's your turn.