ISMS Copilot

io.github.tristanroth1Published by GitHub account tristanroth1v0.3.2Updated Oct 26, 2026

The compliance specialist your AI calls: ISO 27001, SOC 2, GDPR, NIS 2, DORA and more.

VerifiedStreamable HTTPWeb executableKnowledge & MemorySecurity & Monitoring

Overview

AI-generated overview

Remote ISMS Copilot connector that lets an assistant hand compliance work — framework interpretation, policy drafting, control mapping and gap analysis — to a…

What you can do
  • Start and continue specialist conversations, one per deliverable, saved to your account
  • Read plan, workspaces, document names and processing status, memories, company profile and client companies
  • Use a workspace's processed documents as context when answering in that workspace
  • Create workspaces, add or update memories and update your company profile
  • Create, update, link and delete client companies for multi-client advisory work
When to use it
Useful when you need help with ISO 27001, SOC 2, GDPR, NIS 2, DORA, the EU AI Act, HIPAA, PCI DSS or similar frameworks: drafting policies, mapping controls, justifying a Statement of Applicability, writing risk register entries or preparing for an audit.
Requirements
A remote Streamable HTTP endpoint; no local runtime, package or API key. Requires an ISMS Copilot account and OAuth 2.1 sign-in and consent on first tool use. Network access to the ISMS Copilot server.
Before you install
Tool calls send data to the ISMS Copilot server, including questions, memories, company context, workspace and document requests and any excerpt the assistant quotes. Some tools write: creating workspaces, updating memories and company profile, and creating, updating, linking or deleting client companies. Answers are AI-generated general compliance information, not legal advice.

Installation

In SourceWeft

  1. Open ISMS Copilot in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.tristanroth1%2Fismscopilot-account/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "isms-copilot": {
      "type": "http",
      "url": "https://account.ismscopilot.com/v1/account/mcp"
    }
  }
}

README

ISMS Copilot

The compliance specialist your AI calls.

ISMS Copilot is a governance, risk and compliance (GRC) assistant. Connect your ISMS Copilot account and Claude can hand it the compliance part of your work: framework interpretation, policy drafting, control mapping, gap analysis, Statement of Applicability justifications, risk register entries and audit preparation for ISO 27001, ISO 27701, ISO 42001, SOC 2, GDPR, NIS 2, DORA, the EU AI Act, the Cyber Resilience Act, NIST SP 800-171 and CMMC, HIPAA and PCI DSS.

What the connector does:

  • Starts and continues conversations with the ISMS Copilot specialist, one conversation per deliverable, saved to your ISMS Copilot account.
  • Reads your plan name, workspaces, document names and processing status, memories, company profile and client companies, so answers fit your organization. When you ask the specialist in a workspace, it may use that workspace's processed documents as context for its answer.
  • Creates workspaces, adds or updates memories and updates your company profile when you ask. If you advise several organizations, it can also create, update, link and delete client companies (one profile per client); deleting a company unlinks its workspaces and never deletes workspace data.

What it does not do: it does not read Claude's chat history or files you upload to Claude, no tool returns a stored file as such, and it has no payment, checkout or API key tools.

Sign in with your ISMS Copilot account; new users can create one on the sign-in page. ISMS Copilot uses AI. Answers are general compliance information, not legal advice: have a qualified professional review legal or regulatory interpretations before you rely on or share them. ISMS Copilot is made by Better ISMS and is not affiliated with Microsoft or GitHub.

What this plugin contains

  • One remote MCP server, ismscopilot, at https://account.ismscopilot.com/v1/account/mcp (Streamable HTTP). The first time a tool runs, your client opens the ISMS Copilot sign-in and consent page (OAuth 2.1). The plugin stores no credentials and asks for no API key.
  • One skill, get-started, that tells the assistant what to hand to the specialist and what stays on your machine.

It has no hooks, scripts, commands or local code. It sends data only to the ISMS Copilot server above: whatever the assistant puts into a tool call (questions for the specialist, memories, company context, workspace and document requests, including any excerpt it chooses to quote).

Install

Claude Code

bash
claude plugin marketplace add better-isms/ismscopilot-pluginclaude plugin install ismscopilot@ismscopilot

Then run /mcp, pick ismscopilot and sign in. Or add the server on its own:

bash
claude mcp add --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp

Gemini CLI

bash
gemini extensions install https://github.com/better-isms/ismscopilot-plugin

Restart Gemini CLI, then run /mcp auth ismscopilot to sign in.

Other MCP clients

Setup guide: https://docs.ismscopilot.com/docs/agents/connect-any-mcp-client

Links

Package layout (maintainers)

  • .claude-plugin/plugin.json: Claude Code manifest (it also carries the extensions.com.openai block, which Claude Code ignores).
  • .cursor-plugin/plugin.json: Cursor manifest (cursor.directory); points Cursor at .mcp.json.
  • .claude-plugin/marketplace.json: one-plugin Claude Code marketplace, so the repo installs with claude plugin marketplace add.
  • .mcp.json: the MCP server entry for Claude Code (type http).
  • gemini-extension.json and GEMINI.md: Gemini CLI extension manifest and its context file.
  • plugin.json and mcp.json: Agent Plugins manifest and server entry for the ChatGPT and Codex plugins directory.
  • skills/get-started/SKILL.md: onboarding skill.
  • assets/logo.png: listing icon.

Releases use merge-commit PRs to main. Raise version in the manifests with every release.

License

MIT. See LICENSE.

Source: README.md at commit 7443db4

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

5
  1. v0.3.2LatestOct 26, 2026
  2. v0.3.1Oct 14, 2026
  3. v0.3.0Oct 7, 2026
  4. v0.2.1Oct 6, 2026
  5. v0.2.0Sep 18, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts