Connect any MCP client

claude.ai, Claude Desktop, Claude Code and ChatGPT connect by sign-in: add the server URL with no header, sign in to ISMS Copilot when the client asks, and click Approve. There is no token to copy. Other clients use a personal access token (section 3).

1. Endpoint

https://account.ismscopilot.com/v1/account/mcp

Transport: HTTP MCP.
Auth: sign in to ISMS Copilot and approve (OAuth). Fallback: Authorization: Bearer pat-isms-…

2. Client steps

claude.ai and Claude Desktop (custom connector)

These steps are claude.ai's. Claude Desktop uses the same connectors as your Claude account.

1. In Claude, open Customize → Connectors, click + Add, then Add custom connector.
2. Name it ISMS Copilot, paste the endpoint above as the remote MCP server URL, and continue.
3. Leave the advanced OAuth fields empty and add no request headers.
4. Click Add, then Connect. Sign in to ISMS Copilot and click Approve.

In a Claude Team or Enterprise organization, an Owner adds the connector once under Organization settings → Connectors (Add, then Custom, then Web). Each member then finds it under Customize → Connectors and clicks Connect, signing in with their own ISMS Copilot account. Nobody acts as someone else.

ChatGPT (custom MCP app)

ChatGPT connects with sign-in and its default settings. There is no ISMS Copilot listing in ChatGPT's app directory: add it yourself as a custom app.

1. In ChatGPT's settings, turn on developer mode (in recent versions it sits with the app settings). On Business and Enterprise workspaces an admin may need to allow custom MCP apps first.
2. Create a custom app (ChatGPT may call it a connector), name it ISMS Copilot, and paste the endpoint above as the MCP server URL.
3. Choose OAuth as the authentication and keep the default settings.
4. Create it, then connect: sign in to ISMS Copilot and click Approve.

ChatGPT's menu names change between plans and releases. OpenAI's current steps: Developer mode and MCP apps in ChatGPT.

Claude Code

claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp

Then run /mcp in a session, pick ismscopilot, sign in and click Approve. Full walkthrough: Connect ISMS Copilot to Claude Code.

Cursor and Codex

Use a personal access token: config shapes in Connect Cursor and Codex. They can also connect with sign-in where the client supports MCP OAuth.

Any other client

Add a remote HTTP MCP server with the endpoint above and a personal access token (section 3). A client that supports MCP sign-in may also connect without a token.

What you approve

The client can read your account, workspaces, documents (metadata), memories and companies; ask ISMS Copilot and read replies; create, update and link companies to workspaces (up to your plan's limit), edit memories, and create workspaces. It cannot create API keys or buy credits. Changes it makes are labeled in ISMS Copilot as Added by OAuth app: <name> or Updated by OAuth app: <name>, with the name the client registered. Disconnect it any time in Settings → Connected apps, under Connected agents.

3. Personal access token

For Cursor, Codex and other clients that do not sign in, or for CI and headless machines:

1. In chat.ismscopilot.com, open Settings → Connected apps → Create token. Copy the pat-isms-… value once.
2. Add the server with the header Authorization: Bearer pat-isms-…. Claude Code:

claude mcp add --scope user --transport http ismscopilot \
  https://account.ismscopilot.com/v1/account/mcp \
  --header "Authorization: Bearer pat-isms-..."

Keep --scope user so the server is available in every folder. Cursor and Codex token configs: Connect Cursor and Codex.

4. Modes (Fast, Think, Beyond)

create_conversation and send_message take optional mode:

A Fast or Think turn that returns status: "generating" is shorter: poll get_reply about every 2-5 seconds.

The connection does not auto-pick a mode from the question. Ask the agent to “use Beyond” when you want that path. Details: Using Beyond mode.

5. Smoke test

Ask the agent to list your ISMS Copilot workspaces. If tools do not appear, restart the client after adding the server, check that you finished the sign-in and clicked Approve, or, with a token, confirm it was not truncated when pasted.

If you hit a usage limit

Sign-in connections (Claude, ChatGPT): the error text states the limit and when it resets, with no upgrade invitation. The JSON carries reset_at but never upgrade_url, usage_url or extra_usage_buyable. The upgrade and purchase fields described below appear only on personal access token connections.

The connection uses the same 4-hour UTC session window as the chat app. If create_conversation or send_message hits the cap, the first error text is the wait-or-upgrade sentence (including the next reset time) and the JSON block includes reset_at. Solo accounts and organization owners also get upgrade_url. Organization members get the team sentence instead: ask the owner for extra usage, or wait until the next 4-hour window. Their JSON carries quota_scope, org_role, and extra_usage_buyable, and no upgrade link.

Wait until reset_at, or open upgrade_url in a browser while logged into the same ISMS Copilot account (solo accounts and organization owners). When the JSON carries fallback_available: true and your plan's overflow is available (solo paid accounts with Advanced Data Protection off; never on a team pool), you can also tell the agent to continue: on your explicit go-ahead it re-sends with overflow_consent: true and the turn runs on the same up-to-2x overflow the web app offers (the reply carries overflow_active: true). Read tools still work after the chat cap.

See What to do when you hit your usage limit.

6. Disconnect or rotate

Disconnect a sign-in connection in Settings → Connected apps, under Connected agents. The next call from that client is refused until you sign in and approve again.

For a token, remove the server and add it again with a new token:

claude mcp remove ismscopilot

Always revoke the old token in Settings if it may have leaked.