MCP Server: AI-Native Compliance via Cursor and Claude

Developers lose flow context-switching between IDE and GRC dashboard. Compliance checks that live in the same workflow where code is written, reviewed and shipped get run; checks that require a separate login get postponed. An MCP integration makes the live posture queryable from the place where remediation actually happens.

Natural-language access matters because compliance questions are ad-hoc: 'Are there any open high-severity findings blocking our ISO 27001 score?' is not a dashboard filter you pre-build, it is a question you ask when you need to ship. A read-only tool that answers it from live data removes the latency between asking and knowing.

Engineering-led organisations on the Business plan and above already run the automated scanning pipeline and the Gantt roadmaps; exposing that data via MCP turns every IDE into a compliance-aware surface without duplicating data or creating a new privileged access path.

Model Context Protocol integration via SSE transport, The server is exposed at /api/mcp/sse (GET for the event stream, POST for JSON-RPC messages over the same connection, per the MCP SSE spec). Any MCP client that speaks SSE can connect: Cursor (via mcp.json), Claude Desktop (via claude_desktop_config.json), or VS Code with an MCP extension. The same EuroCompliant tenant isolation that gates the REST API gates the MCP server, every tool call is scoped to the organisation whose API key authenticated it.

Authentication, In Settings → API Keys & MCP, generate a tenant API key (ApiKey model: name, key_hash = SHA-256 of the raw key, key_prefix for display, permissions=read, active flag). Copy the raw key once (it is hashed at rest, like a password). Every MCP request carries it as X-API-Key header (or Authorization: Bearer <key> for the streamed SSE GET). The key's value is never logged; only the prefix and company_id are. Scoping is enforced per-request via the same company_id filter that backs every tenant query, so two tenants sharing the same MCP server never see each other's findings.

Available tools, Three read-only tools, all live-database queries, no mutations: get_system_compliance_status (params: system_name?, returns risk classification, checklist progress per framework, framework scores, and the single next deadline for that system; omit system_name for the global posture), list_open_security_findings (params: severity in [high,critical]?, framework in [GDPR, EU AI Act, DORA, ISO_27001, CRA]?, returns title, severity, framework, article_reference, finding_type, description, status=open, created_at, blocking the ISO 27001 score exactly as the dashboard does), and check_shadow_ai_status (no params, returns counts of systems discovered by syft_ai_framework vs manually registered, with the promoted system names and the SBOM evidence that triggered promotion). Each tool returns JSON that the LLM then narrates back in natural language.

Compliance summary resource, Beyond tools, the MCP server exposes a single resource, compliance://summary, that any client can subscribe to: a high-level JSON snapshot (active frameworks, global compliance score, urgent findings count, pending obligations count). Poll it for continuous monitoring without re-asking the question.

Read-only, scoped, and plan-gated, All MCP tools are read-only (they query AuditLog, ScanFinding, AISystem, RiskAssessment, ComplianceChecklist but never write). Access is included with the Business plan (899 EUR/mo) and above; Free and Starter see an upgrade prompt in the same API Keys tab. Every call is logged to the hash-chained AuditLog as audit.export or mcp.query, so the fact that an auditor queried via MCP is itself evidenced.