LowerPlane exposes a Model Context Protocol (MCP) server that lets AI assistants like Claude, ChatGPT, Cursor, and others interact with your compliance data securely.
Overview
The MCP server provides read access to your compliance platform through 17 tools covering:
- Compliance — readiness scores, gaps, framework status
- Controls — list and inspect controls with implementation status
- Policies — browse policies, versions, approval status
- Tests — view test results, schedules, pass/fail status
- Risks — risk register entries with scores and ownership
- Evidence — collected evidence inventory
- Personnel — employee directory
- Vendors — vendor list with risk levels
- Integrations — connected integrations and sync status
- Training — course catalog and completion
- Tasks — compliance task assignments
- Incidents — security incident tracking
Authentication
The MCP server authenticates using your LowerPlane API key. Generate one from Settings > API Keys.
Your API key grants the same access level as your organization. Treat it like a password — do not share it publicly or commit it to version control.
Endpoint
POST https://mcp.lowerplane.com/api/v1/mcp
Setup
Claude Code (CLI)
Claude Desktop
Cursor
ChatGPT
Add the MCP server with a single command:claude mcp add --transport http lowerplane https://mcp.lowerplane.com/api/v1/mcp \
--header "Authorization: Bearer lp_live_your_api_key_here"
> What's our SOC 2 compliance score?
> Show me all failing tests
> List policies that need approval
- Go to Settings > Connectors > Add custom connector
- Enter the MCP endpoint URL:
https://mcp.lowerplane.com/api/v1/mcp
- Select HTTP transport
- Add your API key in the Authorization header
- Click Connect
Add to your Cursor MCP configuration (.cursor/mcp.json):{
"mcpServers": {
"lowerplane": {
"transport": "http",
"url": "https://mcp.lowerplane.com/api/v1/mcp",
"headers": {
"Authorization": "Bearer lp_live_your_api_key_here"
}
}
}
}
Use the OAuth or API key connector in ChatGPT settings to connect to:https://mcp.lowerplane.com/api/v1/mcp
Compliance & Dashboard
| Tool | Description |
|---|
get_compliance_overview | Returns compliance scores for all enabled frameworks |
get_compliance_gaps | Lists open compliance gaps, optionally filtered by framework |
Controls
| Tool | Description |
|---|
list_controls | List controls with status, filterable by framework and status |
get_control_details | Get detailed info for a specific control including mappings |
Policies
| Tool | Description |
|---|
list_policies | List all policies with status, version, and ownership |
get_policy_details | Get full details for a specific policy |
Tests & Monitoring
| Tool | Description |
|---|
list_tests | List tests with status/severity, filterable by category and status |
get_test_results | Get the latest run results for a specific test |
Risk Management
| Tool | Description |
|---|
list_risks | List risk register entries, filterable by status |
Evidence
| Tool | Description |
|---|
list_evidence | List evidence items, optionally filtered by control |
Frameworks
| Tool | Description |
|---|
list_frameworks | List all enabled compliance frameworks |
Personnel
| Tool | Description |
|---|
list_people | List employees with department, role, and status |
Vendors
| Tool | Description |
|---|
list_vendors | List vendors with risk level and category |
Integrations
| Tool | Description |
|---|
list_integrations | List connected integrations with sync status |
Training
| Tool | Description |
|---|
list_training_courses | List training courses with completion info |
Tasks
| Tool | Description |
|---|
list_tasks | List compliance tasks, filterable by status |
Incidents
| Tool | Description |
|---|
list_incidents | List security incidents with severity and status |
Example Queries
Once connected, you can ask your AI assistant questions like:
- “What is our overall compliance readiness?”
- “Show me all controls that are not implemented for ISO 27001”
- “Which policies are still in draft status?”
- “List all critical and high severity test failures”
- “What are our top risks by score?”
- “Show vendors with high risk level”
- “Which training courses have low completion rates?”
- “List overdue compliance tasks”
Security & Permissions
- The MCP server provides read-only access to your compliance data
- All queries are scoped to your organization — no cross-tenant access is possible
- API key permissions from Settings > API Keys apply
- No compliance data is cached by the AI — it is retrieved fresh per request
- All MCP requests are logged in your organization’s audit trail
The MCP server uses stateless HTTP transport. Each request is independent — no session data is stored between requests.
