Iso27001 MCP

Export an audit report including findings and CAR status in markdown or JSON format.

Render one of 6 Mustache evidence templates (access_review_attestation, training_acknowledgement, supplier_security_questionnaire, incident_post_mortem, bcp_test_report, risk_treatment_sign_off) with org-profile auto-injection. Returns rendered Markdown and simultaneously registers an evidence record.

Generate a prioritised remediation roadmap from a gap assessment, grouped by risk level and theme.

Export the full risk register in markdown, CSV, or JSON format with optional level/status filters.

Generate a Statement of Applicability from a gap assessment, pre-populating inclusion/exclusion for all controls.

Retrieve the 2022 attribute tags for a control: information_security_properties, cybersecurity_concepts, operational_capabilities, security_domains.

Bulk-update control implementation statuses in a gap assessment from a CSV string. Supports dry_run=true for validation preview. Omit confirmed or pass confirmed=false to preview the import without writing; pass confirmed=true to commit. Headers: control_id, status, notes, na_justification.

Bulk-import risks from a CSV string. Supports dry_run=true for validation preview. Omit confirmed or pass confirmed=false to preview the import without writing; pass confirmed=true to commit. Headers: asset, threat, vulnerability, likelihood (1–5), impact (1–5), owner, status, related_controls (semicolon-separated).

Link an evidence record to an existing GitHub issue by number, or create a new issue from a title and body.

Link an evidence record to an existing Jira ticket by key, or create a new ticket from a summary.

List all API keys with their metadata (label, role, status, expiry). Never returns key hashes.

List ISO 27001:2022 clause requirements (clauses 4–10), optionally filtered by parent clause.

List ISO 27001 controls with optional filters: version, theme, control_type, new_in_2022, cybersecurity_concept, and pagination.

List evidence records for a control, optionally filtered by status (current, stale, expired).

List generated evidence documents with optional filters: template_type, generated_by, control_id, and pagination.

List gap assessments filtered by status (active, archived, all).

List improvement opportunities with optional filters (status, source, priority, review_id) and a backlog health rating (excellent/good/fair/needs_attention/at_risk).

List management reviews with optional status filter and pagination.

List policies with optional filters: status, type, owner, overdue_only, and pagination.

List procedures with optional filters: procedure_type, status, policy_id, overdue_only, and pagination.

List recorded risk acceptance decisions with optional filters (risk_id, decision) and pagination.

List risks with optional filters: risk_level, status, owner, and pagination.

Query the tamper-evident audit log with optional filters: date range, tool, outcome, role, key_hash, actor_type (ai | human | system).

Record an audit finding (NC, observation, or OFI) against a clause or control. Omit confirmed or pass confirmed=false to preview the finding without writing; pass confirmed=true to commit.

Record one of the 7 mandatory Clause 9.3.2 input categories for a management review. Upserts on re-submission; advances status to in_progress on first input.

Record a Clause 9.3.3 output decision (improvement_decision or isms_change_decision) for a management review.

Record a risk owner's decision to accept or reject residual risk (ISO 27001:2022 §6.1.3), freezing inherent/residual scores and the acceptance threshold at decision time. Requires residual scores on the treatment plan when one is referenced; accepting an above-threshold residual demands a substantive rationale. Omit confirmed or pass confirmed=false to preview; pass confirmed=true to commit.

Register an evidence artefact linked to a control with type, source URL, collector, and optional expiry date. Omit confirmed or pass confirmed=false to preview the evidence record without writing; pass confirmed=true to commit.

Revoke an API key by label, preventing all future use and evicting its live SSE sessions. Omit confirmed or pass confirmed=false to preview without writing; pass confirmed=true to commit.

Full-text search across control names, descriptions, and guidance using the FTS5 index.

Upsert the singleton organization profile (legal name, jurisdiction, ISMS scope, RACI roles). Used by create_policy and create_procedure to auto-inject org defaults.

Upsert the organisation's singleton risk methodology: likelihood/impact scales, calculation method, risk level bands, acceptance threshold, escalation rules, and review frequency. Omit confirmed or pass confirmed=false to preview the diff against the current methodology without writing; pass confirmed=true to commit.

Set the implementation status of a control within a gap assessment (implemented, partial, not_implemented, na, not_started). Omit confirmed or pass confirmed=false to preview changes without writing; pass confirmed=true to commit.

Update a corrective action's status, root cause, evidence reference, or effectiveness verification.

Advance an improvement opportunity's status (forward-only: open → in_progress → implemented → closed) or update owner, target date, priority, or description.

Create a new version of an existing policy with scope/owner changes, reviewed_by, and change_summary. Requires admin role. Omit confirmed or pass confirmed=false to preview the version bump and metadata diff without writing; pass confirmed=true to commit.

Archive the current procedure version and re-render with updated fields, incrementing the version number. Requires admin role. Omit confirmed or pass confirmed=false to preview the version bump and metadata diff without writing; pass confirmed=true to commit.

Update mutable fields of an existing risk (asset, threat, vulnerability, likelihood, impact, owner, status, related_controls). Omit confirmed or pass confirmed=false to preview a field-level diff without writing; pass confirmed=true to commit.

Update an SoA entry's inclusion status, justification, implementation status, and responsible party. Omit confirmed or pass confirmed=false to preview changes without writing; pass confirmed=true to commit.

Update the status and evidence reference for an existing risk treatment plan. Omit confirmed or pass confirmed=false to preview changes without writing; pass confirmed=true to commit.

Record an independent verification of an evidence artefact: reviewer (must differ from the collector), verification_status (verified | rejected), sufficiency (required when verified), and an optional assertion. Omit confirmed or pass confirmed=false to preview without writing; pass confirmed=true to commit.