Compliance and GRC MCP servers compared

Which GRC platforms have an MCP server?

GRC stands for governance, risk and compliance: software in which a company keeps its risks, policies, suppliers and evidence, for example for ISO 27001 or its NIS 2 obligations. MCP (Model Context Protocol) is the open standard an AI assistant such as Claude or ChatGPT uses to work with such software.

Vanta, Drata, Secureframe, Sprinto, Kertos and Cyberday each describe an MCP server. All six name sign-in through OAuth, in the browser with the person's own account. Vanta, Drata, Sprinto and Kertos state that the assistant can do only what the person's role allows.

Secureframe and Sprinto also offer an API key. At Secureframe everyone except admins needs such a key, or the right to create one, even for OAuth.

We compare what the vendors themselves write, as of October 2026. We have not tested their servers, and we give no ranking. We describe the NIS 2 walkthrough's MCP server along the same questions, from its code.

May the assistant write and delete?

Vanta lists as write actions creating or updating a risk, updating an issue's status and uploading a policy document. In the privacy programme this includes deleting, for example processing activities. Drata has scopes for creating, updating and deleting; what can be deleted is evidence, risks and vendors.

Secureframe writes that its server can create, update and delete. Sprinto lists, among others, creating risks, policies, controls and vendors, updating policies and closing incidents. Its page says nothing about deleting.

Kertos describes a connection with read permission and names no write actions: the assistant sees exactly what the person's own Kertos user can see. Cyberday reads tasks, documentation items and events, and so far the assistant can create only documentation items there.

In the NIS 2 walkthrough the assistant fills in what the items ask for: fields, lists, the inventory, ratings, agreements and policy texts. It does not delete a supplier, an asset or a training. It does replace an answer, though, and it saves the crypto list as a whole, so an entry it leaves out drops off the list.

Who switches the assistant on?

At Sprinto an admin turns MCP on for the organisation; according to Sprinto, turning it off stops all of the organisation's MCP connections immediately. Cyberday writes that MCP access is disabled by default and an admin has to enable it explicitly.

At Drata an administrator sets which scopes are available over MCP at all. Each person gets the intersection of those scopes and their role. At Vanta, according to its help pages, any user can connect; a small set of tools is reserved for admins.

In the NIS 2 walkthrough the switch "Allow AI assistants for this company" is off until an admin turns it on. It is checked on every call, and turning it off ends every connected assistant. The assistant of a person with the Reviewer role reads but fills in nothing.

What stays with a person?

Under Art. 20(1) NIS 2, management bodies approve the cybersecurity risk-management measures and oversee their implementation. In Germany, § 38(1) BSIG obliges management to implement the measures and oversee their implementation. Neither provision says whether an assistant may help.

Secureframe advises reviewing what the assistant is about to do before confirming, especially updates, deletes and archive actions. Drata advises admins to grant scopes that change data deliberately.

Sprinto lists among its MCP actions sending policies for approval or approving them. The assistant can also approve or reject steps in approval workflows there, as far as the person's role allows. We found no page from any of the vendors that excludes the assistant from approvals.

In the NIS 2 walkthrough the assistant finishes no item, decides none and signs nothing, because the server has no tool for it. The management review and the approval at item 7.3 exist only in the app.

Art. 20(1) NIS 2 · § 38(1) BSIG

How the NIS 2 walkthrough's MCP server is built

Its code is open, under the AGPL 3.0 licence. Every installation serves its MCP server at /api/mcp, including one on your own servers, and signs assistants in itself, with no third-party service.

Assistants sign in through the browser, using OAuth 2.1 with automatic registration, or with a key that lasts 90 days. Each person can make 300 calls an hour.

Cyberday writes that every action and data pull made through MCP is logged. In the walkthrough every change appears in the activity log under the person's name, with "via" and the assistant's name. Every screen an assistant wrote also carries a mark with its name and the day.