SOC 2 Compliance

io.github.CSOAI-ORGPublished by GitHub account CSOAI-ORGv1.0.15Updated Oct 30, 2026

SOC 2 Type II compliance for trust services criteria (security, availability, processing

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Local MCP server that helps an assistant assess SOC 2 Trust Service Criteria controls, find gaps, and plan audit readiness.

What you can do
  • Assess controls against the five SOC 2 Trust Service Criteria principles
  • Compare current controls with SOC 2 expectations and identify gaps
  • Generate a SOC 2 control matrix from controls and evidence
  • Score overall audit readiness across principles
  • Produce evidence checklists by principle and prioritized remediation plans
When to use it
Useful when preparing for a SOC 2 Type II audit or reviewing whether existing controls and evidence meet Trust Service Criteria, and you want the assistant to draft gap analyses, matrices and remediation plans.
Requirements
Runs as a local process over stdio, installed from the PyPI package soc2_compliance_ai_mcp with Python and the mcp package; the README shows a manual server configuration for desktop clients. No authentication, environment variables or headers are declared.
Before you install
The README advertises paid tiers and Stripe purchase links, and a free tier limited to 10 assessments per day, so check licensing before relying on it. Outputs are advisory compliance drafts, not an audit opinion. The README also promotes unrelated EU AI Act and governance products.

Installation

In SourceWeft

  1. Open SOC 2 Compliance in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[MCP Scorecard: 86/100]

Soc2 Compliance Ai MCP

⚖️ Built by MEOK AI Labs / CSOAI. Need this applied to your system fast? Book a 30-min Founder Office Hour (£29) → https://meok.ai/work · Full governance platform → https://meok.ai

[MEOK AI Labs] [GSPC] [License] [PyPI]

SOC 2 Type II compliance MCP — Trust Service Criteria audit, access review, change management, co... mcp-name: io.github.CSOAI-ORG/soc2-compliance-ai-mcp

SOC 2 Compliance MCP

SOC 2 Trust Service Criteria — Security, Availability, Processing Integrity, Confidentiality, Privacy

[MCP] [License]

SOC 2 Type II compliance MCP — Trust Service Criteria audit, access review, change management, control evidence automation.

🚀 Quick Start

bash
# Install via pippip install soc2_compliance_ai_mcp
# Or install via Smitherynpx -y @smithery/cli@latest install soc2-compliance-ai-mcp --client claude

✨ Features

  • MCP protocol compliant
  • Easy installation
  • Well-documented API
  • Production-ready
  • Active maintenance

📖 Documentation

🛡️ Compliance

This MCP server is built with EU AI Act compliance built-in:

  • ✅ Article 9 — Risk Management System
  • ✅ Article 13 — Transparency & Instructions for Use
  • ✅ Article 15 — Bias Detection & Testing
  • ✅ Article 26 — FRIA Support (where applicable)
  • ✅ Article 50 — AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic →

🏢 Enterprise

Need custom development, SLA guarantees, or white-label deployment?

  • Pro: $99/mo — Full MCP suite + EU AI Act tracking
  • Enterprise: $499/mo — Custom dev + SLA + Dedicated support

View Pricing → | Contact Sales →

🤝 Part of the MEOK Ecosystem

This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.

DomainPurpose
councilof.aiEU AI Act compliance marketplace
safetyof.aiAI safety & monitoring
meok.aiSovereign AI platform
cobolbridge.aiLegacy modernization

📜 License

MIT © CSOAI-ORG

Built with 💜 by MEOK AI Labs · UK Companies House 16939677

AI-powered SOC 2 compliance automation covering all five Trust Service Criteria. Assess controls, generate control matrices, identify gaps, and produce audit-ready documentation.

Tools

ToolDescriptionParameters
assess_trust_principlesAssess controls against all 5 TSC principlesprinciple, controls
control_gap_analysisIdentify gaps between existing controls and SOC 2current_controls, principle
generate_control_matrixGenerate a SOC 2 control matrixprinciple, controls, evidence
audit_readinessOverall SOC 2 audit readiness scoreall_controls, principles
evidence_checklistGenerate evidence checklist by principleprinciple (str, required)
remediation_planPrioritized remediation plan for gapsfindings, timeline

Installation

bash
pip install mcp

Claude Desktop / Cursor / VS Code / Windsurf

json
{  "mcpServers": {    "soc2-compliance": {      "command": "python",      "args": ["path/to/server.py"]    }  }}

Usage Examples

Assess security principle

json
{  "principle": "security",  "controls": ["firewall", "encryption", "access control", "no monitoring"]}

Generate control matrix

json
{  "principle": "availability",  "controls": ["redundant servers", "backup power", "DR plan"],  "evidence": ["uptime reports", "DR test results"]}

Pricing

  • Free: 10 assessments/day
  • Pro: $99/mo — unlimited assessments + matrices
  • Enterprise: $499/mo — full audit trail + readiness scoring

Built by MEOK AI Labs | meok.ai

💸 Try MEOK in 30 seconds — instant buy ladder

TierPriceWhat you getStripe
Smoke test£1Signed sample MCP-Hardening report + Article 50 PDFhttps://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j
Quick Kit£9EU AI Act Article 50 implementation guide (C2PA + EU-Icon)https://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j
Founder Call£2930-min 1-on-1 with the founderhttps://buy.stripe.com/5kQ6oJ0xS3ce8sl7ew8k91j

Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.

Source: README.md at commit c979ee8

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.15LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts