Connect ISMS Copilot to Claude Code

You can use your ISMS Copilot account directly from Claude Code, Cursor, or any MCP-compatible AI tool. Once connected, your AI tool can read your workspaces, documents, and memories, and hold real ISMS Copilot conversations, acting as you and covered by your existing subscription.

What you need

• An ISMS Copilot account. The connection is covered by your subscription, with no separate billing.
• A terminal with Claude Code (or another MCP client) installed.
• Some capabilities depend on your plan (see Choosing how it answers).

Connect in three steps

1. In ISMS Copilot, open Settings, then Connected apps.
2. Click Create token. Give it a name (for example, "Claude Code laptop"), choose the permissions it should have (see Permissions), and copy the token. You will only see it once.
3. Paste the command shown into your terminal. It looks like this:

claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp --header "Authorization: Bearer pat-isms-..."

Then start your AI tool and ask, for example, "list my ISMS Copilot workspaces."

For Cursor, ChatGPT, or any other MCP client, add the server URL https://account.ismscopilot.com/v1/account/mcp with your token as a Bearer header.

What your AI tool can do

A connected token can read and do the following, and nothing else:

So from your AI tool you can pull up a document, list your workspaces, add or edit a memory, and hold a grounded ISMS Copilot conversation, all without leaving your editor.

Choosing how it answers (Fast, Think, and Beyond)

When you start or continue a conversation from your AI tool, you choose the mode. The connection does not pick it from the question. If the agent omits mode, ISMS Copilot uses Fast.

• Fast (default): quick answers, no extended reasoning.
• Think: deeper reasoning for harder questions. Paid plans only. On a free plan, a Think request falls back to Fast.
• Beyond: multi-step plan, draft, and verify. Paid plans only, 10 runs per UTC day. Minutes-scale. The agent must pass mode: "beyond" on create_conversation or send_message, then poll get_reply until the run completes. If Beyond cannot run, the turn answers through the normal flow and includes beyond_denied_reason.

In practice:

• “Think carefully about this” is enough for Think.
• “Use Beyond” or “run this in Beyond” is enough for Beyond. The agent will not upgrade a hard question on its own.

See Using Beyond mode.

If you hit a usage limit

The connection uses the same 4-hour UTC session window as the chat app. If a conversation tool hits the cap, the first error text is the wait-or-upgrade sentence, including the next reset time. The JSON block includes reset_at and upgrade_url.

You can:

1. Wait until reset_at.
2. Open upgrade_url in a browser while logged into the same ISMS Copilot account.
3. When the JSON carries fallback_available: true and your plan's overflow is available, tell the agent to continue: on your explicit go-ahead it re-sends with overflow_consent: true and the turn runs on the same up-to-2x overflow the web app offers (the reply carries overflow_active: true).
4. Keep using read tools. Workspaces, memories, documents, and account info still work after the chat cap.

See What to do when you hit your usage limit.

Settings stay in the web app

Your account settings are read-only from the connection. In particular, Advanced Data Protection (which routes your data through an EU-based, zero-retention provider) cannot be turned on or off from your AI tool.

If you ask your AI tool about Data Protection, it can report whether it is enabled for your account and will point you to Settings, Data Protection at chat.ismscopilot.com to change it. This is deliberate: a connection token should not be able to flip a global data-residency setting.

Permissions

When you create a token, you choose exactly what it can do (read workspaces, read documents, read and write memories, start conversations, and so on). Grant only what you need. A token that only reads your workspaces cannot change your memories or start conversations.

You can see and revoke every token at any time in Settings, Connected apps.

Reconnecting or rotating a token

If you have connected before and want to reconnect (for example, after creating a fresh token), remove the existing server first. Otherwise your AI tool keeps the old token:

claude mcp remove ismscopilot

Then paste the new command from Settings, Connected apps.

Security

• A token acts as you, so it can reach exactly what your account can already reach, limited by the permissions you granted.
• It is covered by your subscription, with no separate billing.
• You can revoke it any time in Settings, Connected apps. Revoking takes effect immediately.
• Treat a token like a password. If one is exposed, revoke it and create a new one.

Troubleshooting

• Connected but the tools do not show up: re-run the connect command with --scope user, or run claude mcp remove ismscopilot and add it again.
• Authentication failed: the token may have been revoked or expired. Create a new one in Settings, Connected apps.
• Think mode does not seem deeper: Think requires a paid plan. On a free plan it falls back to Fast.
• Beyond ran as a normal answer: the agent likely omitted mode. Ask it to send mode: "beyond", or say “use Beyond” on the next turn. Check beyond_denied_reason if a Beyond request was downgraded.