Iso27001 MCP runs on your own machine — the client starts it, so there is no endpoint to ping. 45 installs a week from npm. Last commit 5 Sep 2026.
ISO 27001 compliance workspace for Claude. Risks, policies, SoA, evidence, and audit workflows.
Nothing serious here today
Today is the operative word: we check Iso27001 MCP every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add iso27001-mcp -e 'DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY>' -e 'HMAC_SECRET=<HMAC_SECRET>' -e 'MCP_API_KEY=<MCP_API_KEY>' -- npx -y iso27001-mcp{
"mcpServers": {
"iso27001-mcp": {
"command": "npx",
"args": [
"-y",
"iso27001-mcp"
],
"env": {
"DB_ENCRYPTION_KEY": "<DB_ENCRYPTION_KEY>",
"HMAC_SECRET": "<HMAC_SECRET>",
"MCP_API_KEY": "<MCP_API_KEY>"
}
}
}
}[mcp_servers.iso27001-mcp]
command = "npx"
args = ["-y", "iso27001-mcp"]
env = { DB_ENCRYPTION_KEY = "<DB_ENCRYPTION_KEY>", HMAC_SECRET = "<HMAC_SECRET>", MCP_API_KEY = "<MCP_API_KEY>" }{
"mcpServers": {
"iso27001-mcp": {
"command": "npx",
"args": [
"-y",
"iso27001-mcp"
],
"env": {
"DB_ENCRYPTION_KEY": "<DB_ENCRYPTION_KEY>",
"HMAC_SECRET": "<HMAC_SECRET>",
"MCP_API_KEY": "<MCP_API_KEY>"
}
}
}
}{
"servers": {
"iso27001-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"iso27001-mcp"
],
"env": {
"DB_ENCRYPTION_KEY": "<DB_ENCRYPTION_KEY>",
"HMAC_SECRET": "<HMAC_SECRET>",
"MCP_API_KEY": "<MCP_API_KEY>"
}
}
}
}Put your own values in place of
<DB_ENCRYPTION_KEY> (32-byte hex key for AES-256 SQLite encryption (generated by iso27001-mcp init)), <HMAC_SECRET> (32-byte hex secret for HMAC-signing API keys (generated by iso27001-mcp init)), <MCP_API_KEY> (API key for authenticating tool calls (generated by iso27001-mcp keygen)).
The author’s registry entry marks them as required.
Optional settings from the registry entry, left out of the block above:
DB_PATH (Path to the encrypted SQLite database file).
Alternatives to Iso27001 MCP
same job, measured the same wayManage compliance controls, policies, and audit readiness for SOC 2, HIPAA, ISO 27001 and more.
Authenticated MCP server for ClearPolicy policy and compliance workflows.
Audit websites for GDPR, CCPA, and ePrivacy compliance — trackers, consent, and policies.
EU AI Act and GDPR compliance: checks, audits, generate policies.
Location compliance evidence, policies and SOPs with admin-controlled write approvals.
Audit GitHub repos for security, compliance, and EU AI Act exposure from Claude or Cursor.
Engineered GDPR compliance for engineers and AI agents: pull rules, implement, submit evidence.
Compliance, risk, tax and audit checks for AI trading agents: pre-trade, sizing, wash sales, Reg BI.
Iso27001 MCP — questions
Answers built from our own checks of this server.