One URL, your sign-in, your permissions.
Complaica has a built-in MCP server. With it, Claude, ChatGPT, Cursor or VS Code work directly with your compliance data: find gaps against ISO 27001, record evaluations, draft a DPIA. You sign in with your own account, and the assistant can do exactly what you can do in Complaica.
Every assistant follows the same flow. You need a personal Complaica account and a licence package that includes MCP access.
Add the server URL as a new connector or MCP server. Nothing else.
Your browser opens your Complaica instance’s sign-in, or your company SSO if your instance uses one.
The consent screen names the application that asks for access. Choose Accept and the assistant is connected.
Replace <instance> with the address of your Complaica instance. Complaica shows the full URL under Profile → MCP & API access.
In Claude Team and Enterprise an owner adds the connector once for the organization, with the URL only. Every member then connects with their own account. Never enter a token under “Request headers”: it would apply to the whole organization.
claude mcp add --transport http --scope user complaica https://<instance>/mcp
claude mcp login complaicaOr use the Complaica plugin, which brings the server and skills for compliance work: claude plugin marketplace add ciqualia/complaica-plugin, then claude plugin install complaica@complaica --config mcp_url=<instance URL>, then claude mcp login plugin:complaica:complaica. Installing alone does not sign you in.
On Business and Enterprise workspaces an admin may have to allow custom connectors first.
{
"servers": {
"complaica": { "type": "http", "url": "https://<instance>/mcp" }
}
}In .vscode/mcp.json or through “MCP: Add Server”. VS Code asks you to sign in when the server starts.
{
"mcpServers": {
"complaica": { "url": "https://<instance>/mcp" }
}
}In ~/.cursor/mcp.json. Settings → MCP then shows “Needs login”: select it and sign in.
codex mcp add complaica --url https://<instance>/mcp
codex mcp login complaica{
"mcpServers": {
"complaica": { "httpUrl": "https://<instance>/mcp" }
}
}In ~/.gemini/settings.json, then run /mcp auth complaica inside gemini.
npx -y mcp-remote https://<instance>/mcpClients with Streamable HTTP and MCP OAuth need only the URL. For clients that speak only stdio, mcp-remote runs the browser sign-in.
The first time you connect, your browser opens. This is what follows.
Check the connection by asking “Who am I in Complaica?”. The answer must show your name, your roles and your licence.
Do you grant these access privileges?
The server’s tools cover what you do in the web app. Which of them work for you is set by your roles and your licence.
Every tool is marked as reading, changing or deleting. Deletes in Complaica are permanent, and most assistants ask before such calls.
Find, create and change objects, object types, links between objects, tags and custom-field values, including bulk imports.
Read requirements and controls, record and change evaluations per object, find gaps against a standard or catalog.
Threats from catalogs, risk evaluations per object with likelihood, damage and treatment, the risk matrix.
Create, fill in, progress and approve DPIAs, audits, measures and other activities, with documents and links.
Read grids and dashboards, count and group data, the change history of an entry, search across every area.
Generate reports and export grids or evaluations to Excel, as a download link.
In assistants that support MCP Apps, such as Claude, objects, activities, grids and dashboards appear as interactive cards. Other assistants get the same data as text.
Name the concept you mean, and refer to objects, requirements and threats by their names.
“Who am I in Complaica, and which concepts can I access?”
“Which requirements are not yet met for HR Portal in ISMS 2026?”
“Create a DPIA for the processing Applicant management and take purpose and legal basis from this text: …”
“Set the likelihood of G 0.18 Misplanning for Data Center to high, with a short justification.”
“How many requirements are still open per standard in ISMS 2026?”
“Which applications does the process Payroll depend on?”
The MCP server is not a second way in with rules of its own. It is Complaica, signed in as you.
Every call runs as you. The assistant cannot see or change anything you cannot see or change in the web app, and it stops as soon as your licence no longer includes MCP access.
Tools that change or delete data are marked as such, and most assistants ask before running them. The server can also run read-only.
Changes are recorded under your name in the history, like changes made in the web app. Finalized concept versions stay read-only.
What the assistant reads is processed by your assistant’s provider under its terms. Check that your organization’s AI policy allows it for compliance data.
The connector adds no data store of its own. Your data stays in your Complaica instance.
| Support | support@ciqualia.com |
|---|---|
| Security reports | security@ciqualia.com |
| Privacy policy | ciqualia.com/no/personvern/ |
Only the assistant’s tool calls and their arguments, such as “set the evaluation of A.5.1 for HR Portal”. Complaica does not receive your conversation with the assistant.
Changes land in your instance and its history, as from the web app. Sign-in is handled by your instance’s sign-in system; assistants only get access tokens for this one server.
What the assistant reads and writes is processed by its provider under its terms. Complaica passes on nothing beyond that.
Disconnect the assistant and revoke the consent, and it can no longer renew its sign-in; tokens already issued expire shortly. See For administrators.
Who may connect is set in Complaica. Who stays connected is set in your instance’s sign-in system.
Assign a licence package that includes MCP access. Without one, every call is rejected.
The user’s roles, exactly as in the web app.
End the user’s sessions, offline sessions included.
Revoke the user’s consent for that application. They have to connect and consent again.
For scripts and CI. The owner creates and revokes them under Profile → MCP & API access.
| Claude | Customize → Connectors → Complaica → Disconnect |
|---|---|
| Claude Code | claude mcp logout complaica, then claude mcp remove complaica; with the plugin claude mcp logout plugin:complaica:complaica, then claude plugin uninstall complaica@complaica |
| ChatGPT | Settings → Apps & Connectors → Complaica → Disconnect |
| VS Code | MCP: List Servers → complaica → remove |
| Cursor | Settings → MCP → remove complaica |
| Codex CLI | codex mcp logout complaica, then codex mcp remove complaica |
| Gemini CLI | Remove the entry from ~/.gemini/settings.json |
Disconnecting in the assistant does not end the sign-in in Complaica. To be sure, also revoke the consent.
The connection still holds an old token. Disconnect and connect again. After some Complaica updates every connection has to sign in once more.
The URL in your assistant differs from the one under Profile → MCP & API access. Remove the connector and add it again with the exact URL: https, the same host name, /mcp, no trailing slash.
Your licence package does not include MCP access. Your Complaica administrator can assign one that does.
Your role does not allow it, exactly as in the web app. Ask your administrator for the role you need.
The connector was set up with a token in its request headers, or someone else signed in. Remove it, add it again with the URL only and sign in with your own account.
Your instance’s sign-in is not yet fully set up for AI assistants. Contact your administrator or support@ciqualia.com.
We show you Complaica with Claude or ChatGPT on an example of your own.
Takk.
Vi svarer innen én virkedag.
Ikke sendt.
Det gikk ikke. Sjekk feltene eller send oss en e-post direkte.