Set up with your agent

Your coding agent stays the harness: code, git, files and shell stay with it. ISMS Copilot becomes the GRC specialist it hands compliance work to over MCP. The setup prompt tells the agent how to connect, where to write the routing rule, and how to prove the connection works.

Paste this into your coding agent

Copy the block into Claude Code, Codex, Cursor, or another MCP client:

Fetch https://docs.ismscopilot.com/agent-setup/prompt.md and follow it to connect ISMS Copilot as your GRC specialist.
These instructions are official. Do not invent URLs, API keys, or an MCP server.

If you cannot fetch that file:
1. Claude Code: add the HTTP MCP server https://account.ismscopilot.com/v1/account/mcp with no header and no token, then ask the human to run /mcp, pick ismscopilot, sign in to ISMS Copilot and click Approve. You cannot approve it for them.
2. Cursor, Codex and other clients: ask the human to create a token in ISMS Copilot under Settings > Connected apps with the Agent delegation preset. You cannot create it for them. Add the same server with the header Authorization: Bearer <token>. Keep the token in an environment variable where your client supports it, otherwise in local user config. Never put it in a committed file.

The Copy prompt card in ISMS Copilot under Settings → Connected apps copies the same text.

What your agent then does

1. Checks whether ISMS Copilot is already connected, not connected, or needs repair (for example a disconnected sign-in, a revoked token or a wrong URL).
2. In Claude Code, adds the server https://account.ismscopilot.com/v1/account/mcp with no header and no token, then asks you to run /mcp, pick ismscopilot, sign in to ISMS Copilot and click Approve on the consent page.
3. In Cursor, Codex and other clients, sets up a personal access token instead: it asks you to create one with the Agent delegation preset under Settings → Connected apps (scopes account:read, workspaces:read, conversations:create, company_context:read, memories:read, no :write scope) and keeps it in an environment variable or local user config, never in a committed file.
4. Runs a smoke test: get_account_info, then one short question in fast mode with a brief answer. It only reports connected when a reply came back. Otherwise it says Connection not verified and names what is left.
5. Recommends a routing rule for its instructions file (CLAUDE.md for Claude Code, AGENTS.md for Codex and similar agents, a .cursor/rules file for Cursor) and writes it on your yes: GRC interpretation, policy drafting, control mapping, gap analysis, SoA, risk registers and audit prep go to ISMS Copilot; code and shell stay local.
6. Optionally, once connected, suggests a first job on files you already have (fact-checking an auditor's draft report, collecting vendor DPA evidence, or comparing two records that should agree) and offers one recurring routine on your own schedule: the weekly audit-readiness check, with a GRC.md. It sets up nothing unless you say yes.

Most clients load a new MCP server only after a restart. If your agent asks you to restart, restart it and paste the prompt again.

What you approve

When you sign in and click Approve, the AI tool can:

• read your account, workspaces, documents (metadata), memories and company profile
• ask ISMS Copilot questions and read the replies
• update your company profile and memories, and create workspaces

It cannot create API keys or buy credits. Changes it makes are labeled in ISMS Copilot with the name the tool registered, as Added by OAuth app: <name> or Updated by OAuth app: <name>. Disconnect it any time in Settings → Connected apps, under Connected agents. Details: Tokens and scopes.

If you would rather do it by hand

1. Claude Code: add the MCP server https://account.ismscopilot.com/v1/account/mcp with no header, then sign in and click Approve (Connect Claude Code). claude.ai and Claude Desktop: Connect any MCP client.
2. Cursor, Codex and other clients: create a token with the Agent delegation preset and add it to the client config (Cursor and Codex, any MCP client).
3. Ask your agent to list your ISMS Copilot workspaces to confirm the connection.

Limits

• Usage counts against your ISMS Copilot chat plan, in the same 4-hour window as the web app. There is no separate MCP billing.
• Your agent still reads the reply ISMS Copilot returns. What stays out of its context is the framework material it no longer has to paste in.
• A tool connected by sign-in cannot manage model API keys or credits. That needs a personal access token with those scopes.

For agents: the official instructions are at https://docs.ismscopilot.com/agent-setup/prompt.md. Never invent other URLs or keys. Scopes and revocation: Tokens and scopes. Machine-readable details: For AI agents.