Connect ISMS Copilot to Claude Code

You can use your ISMS Copilot account directly from Claude Code, Cursor, or any MCP-compatible AI tool. Once connected, your AI tool can list your workspaces and documents, read your memories, and hold real ISMS Copilot conversations, acting as you and covered by your existing subscription.

What you need

• An ISMS Copilot account. The connection is covered by your subscription, with no separate billing.
• A terminal with Claude Code (or another MCP client) installed.
• Some capabilities depend on your plan (see Choosing how it answers).

Connect in three steps

Already connected with a personal access token? Remove that server first, otherwise Claude Code keeps using it: claude mcp remove ismscopilot.

1. Add the server (no token needed):

claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp

2. In a Claude Code session, run /mcp, pick ismscopilot, and follow the steps in your browser. From a terminal, claude mcp login ismscopilot does the same.
3. Sign in to ISMS Copilot and click Approve on the consent page.

Then ask, for example, "list my ISMS Copilot workspaces."

claude.ai and Claude Desktop connect to the same server URL with the same sign-in: see Connect any MCP client. ChatGPT connects the same way, as a custom MCP app: see the same page. For Cursor and Codex, see Connect Cursor and Codex.

Fallback: connect with a personal access token

Use a token when sign-in is not possible, for example in CI or on a headless machine:

1. In ISMS Copilot, open Settings, then Connected apps.
2. Click Create token. Give it a name (for example, "Claude Code CI"), choose the permissions it should have (see Permissions), and copy the token. You will only see it once.
3. Paste the command shown into your terminal. It looks like this:

claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp --header "Authorization: Bearer pat-isms-..."

What your AI tool can do

A connection can read and do the following, and nothing else. A sign-in connection gets every row below; a token gets the rows its permissions cover:

So from your AI tool you can list your workspaces and documents, create a personal workspace, add or edit a memory, and hold a grounded ISMS Copilot conversation, all without leaving your editor.

Choosing how it answers (Fast, Think, and Beyond)

When you start or continue a conversation from your AI tool, you choose the mode. The connection does not pick it from the question. If the agent omits mode, ISMS Copilot uses Fast.

• Fast (default): quick answers, no extended reasoning.
• Think: deeper reasoning for harder questions. Paid plans only. On a free plan, a Think request falls back to Fast.
• Beyond: multi-step plan, draft, and verify. Paid plans only, 10 runs per UTC day (50 on Unlimited). Minutes-scale. The agent must pass mode: "beyond" on create_conversation or send_message, then poll get_reply about every 10-20 seconds until the run completes. If Beyond cannot run, the turn answers through the normal flow and includes beyond_denied_reason.

In practice:

• “Think carefully about this” is enough for Think.
• “Use Beyond” or “run this in Beyond” is enough for Beyond. The agent will not upgrade a hard question on its own.

A Fast or Think turn that is not ready inline returns status: "generating". The agent then polls get_reply about every 2-5 seconds until it returns complete.

See Using Beyond mode.

If you hit a usage limit

Sign-in connections (Claude, ChatGPT): the error text states the limit and when it resets, with no upgrade invitation. The JSON carries reset_at but never upgrade_url, usage_url or extra_usage_buyable. The upgrade and purchase fields described below appear only on personal access token connections.

The connection uses the same 4-hour UTC session window as the chat app. If create_conversation or send_message hits the cap, the first error text is the wait-or-upgrade sentence (including the next reset time) and the JSON block includes reset_at. Solo accounts and organization owners also get upgrade_url. Organization members get the team sentence instead: ask the owner for extra usage, or wait until the next 4-hour window. Their JSON carries quota_scope, org_role, and extra_usage_buyable, and no upgrade link.

You can:

1. Wait until reset_at.
2. Open upgrade_url in a browser while logged into the same ISMS Copilot account (solo accounts and organization owners).
3. When the JSON carries fallback_available: true and your plan's overflow is available (solo paid accounts with Advanced Data Protection off; never on a team pool), tell the agent to continue: on your explicit go-ahead it re-sends with overflow_consent: true and the turn runs on the same up-to-2x overflow the web app offers (the reply carries overflow_active: true).
4. Keep using read tools. Workspaces, memories, documents, and account info still work after the chat cap.

See What to do when you hit your usage limit.

Settings stay in the web app

Protected account settings are read-only from the connection (companies, above, are the exception: a token with company_context:write can create, update and link them to workspaces, up to your plan's limit). In particular, Advanced Data Protection (which routes your data through an EU-based, zero-retention provider) cannot be turned on or off from your AI tool.

If you ask your AI tool about Data Protection, it can report whether it is enabled for your account and will point you to Settings, Data Protection at chat.ismscopilot.com to change it. This is deliberate: a connection token should not be able to flip a global data-residency setting.

Permissions

When you sign in and click Approve, the tool gets one fixed set: read your account, workspaces, documents (metadata), memories and companies; ask ISMS Copilot and read replies; create, update and link companies to workspaces, edit memories, and create workspaces. It cannot create API keys or buy credits. Changes it makes are labeled in ISMS Copilot with the tool's name, as Added by OAuth app: <name> or Updated by OAuth app: <name>.

When you create a token instead, you choose exactly what it can do (read workspaces, read documents, read and write memories, start conversations, and so on). Grant only what you need. A token that only reads your workspaces cannot change your memories or start conversations.

You can see and disconnect every connection at any time in Settings, Connected apps: tokens in the token list, sign-in connections under Connected agents.

Reconnecting or rotating a token

If a sign-in connection stops working (for example after you disconnected it), run /mcp, pick ismscopilot and sign in again.

If you connected with a token and want to switch to a fresh one, remove the existing server first. Otherwise Claude Code keeps the old token:

claude mcp remove ismscopilot

Then add the server again, with sign-in or with the new token.

Security

• A connection acts as you, so it can reach exactly what your account can already reach, limited by what you approved or the permissions you granted.
• It is covered by your subscription, with no separate billing.
• You can disconnect it any time in Settings, Connected apps. Disconnecting takes effect immediately.
• Treat a token like a password. If one is exposed, revoke it and create a new one.

Troubleshooting

• Connected but the tools do not show up: re-run the connect command with --scope user, or run claude mcp remove ismscopilot and add it again.
• Authentication failed or "needs authentication": a sign-in connection was disconnected or expired: run /mcp and sign in again. A token may have been revoked or expired: create a new one in Settings, Connected apps.
• Think mode does not seem deeper: Think requires a paid plan. On a free plan it falls back to Fast.
• Beyond ran as a normal answer: the agent likely omitted mode. Ask it to send mode: "beyond", or say “use Beyond” on the next turn. Check beyond_denied_reason if a Beyond request was downgraded.