ProductFrameworksPricingTrustDocsAbout
Documentation menu▾

DOCUMENTATION

Connect via MCP

The Model Context Protocol (MCP) is an open standard for giving AI models structured, permissioned access to external services. EquanimGRC exposes a Streamable-HTTP MCP server — so any MCP-capable client (Claude, Claude Code, or a custom agent) can read your compliance posture and take actions within the boundaries you configure.

Authentication model

The MCP server is an OAuth 2.1 Resource Server. Tokens are issued by your organization's self-hosted Authentik instance, which acts as the authorization server. Each token is scoped to the minimum permissions the client needs and is bound to a single tenant — no token can reach another organization's data.

Human users authenticate through a standard browser-based OAuth 2.1 authorization code flow with PKCE. They see a consent screen that lists the exact scopes being requested before granting access. Machine agents use OAuth 2.1 client credentials (see Agents & evidence).

Connecting your MCP client

  1. Request access. The MCP endpoint is available to early-access customers. Use the button below to get on the list.
  2. Register your client. Once access is granted, register your MCP client in your EquanimGRC workspace settings to receive a client ID and the authorization server URL.
  3. Configure transport. Point your client at the Streamable-HTTP endpoint provided in your workspace settings. No additional plugins or adapters are required for standard MCP clients.
  4. Authorize. On first connection, your client will open a browser window for the OAuth consent flow. Approve the scopes listed and the client stores the resulting token automatically.
  5. Start querying. Call any read tool to verify connectivity —get_compliance_posture is a good first call.

Available read tools

Once connected, your client can call these tools (all require mcp:read:posture):

  • list_frameworks, get_framework
  • list_controls, get_control
  • list_policies, get_policy
  • list_evidence, get_evidence_status
  • list_vendors, get_vendor_risk
  • get_compliance_posture, list_gaps, get_audit_readiness
  • list_tasks

The MCP server also exposes a resource at equanimgrc://framework/{slug}/controls for clients that prefer resource reads over tool calls.

Write tools (evidence submission, task management, questionnaire answers) are documented inTools & scopes.

Early access

MCP connectivity is rolling out to early-access customers first. Request access and we'll reach out when it's your turn.