MCP tools

ISO-STANDARD.app exposes a Model Context Protocol (MCP) server so ChatGPT, Claude, Cursor and other MCP-aware assistants can act as the signed-in user against your workspaces. All tool calls run under the same row-level security as the app — an assistant only ever sees the workspaces you're a member of.

Server URL

https://iso-standard.app/mcp

Auth: OAuth 2.1 · Transport: Streamable HTTP

Add the URL to your MCP client. You'll be sent through Supabase login and a consent screen; after approving, the client can call any of the tools below.

`list_organizations`

List your workspaces

read-only

Returns the workspaces (organizations) the signed-in user is a member of, with their role. Use the returned id as organization_id in every other tool.

Inputs

None.

Example call

{
  "name": "list_organizations",
  "arguments": {}
}

`list_risks`

List risks

read-only

Lists risks in a workspace's risk register (title, category, likelihood, impact, status, strategy, owner). RLS restricts results to the signed-in user's workspaces.

Inputs

Name	Type	Required	Description
organization_id	uuid	yes	Workspace id from list_organizations.
status	'open' \| 'mitigated' \| 'accepted' \| 'closed'	no	Filter by risk status.
limit	integer (1-200)	no	Max rows (default 50).

Example call

{
  "name": "list_risks",
  "arguments": {
    "organization_id": "00000000-0000-0000-0000-000000000000",
    "status": "open",
    "limit": 25
  }
}

`create_risk`

Create risk

writes data

Adds a new risk to a workspace's risk register. Likelihood and impact are 1-5. Requires an editor role in the target workspace (enforced by RLS).

Inputs

Name	Type	Required	Description
organization_id	uuid	yes	Workspace id from list_organizations.
title	string (1-240)	yes	Short risk title.
likelihood	integer 1-5	yes	Likelihood rating.
impact	integer 1-5	yes	Impact rating.
description	string (≤4000)	no	Detailed description.
category	string (≤120)	no	e.g. 'Information Security'.
owner	string (≤120)	no	Owner name or role.

Example call

{
  "name": "create_risk",
  "arguments": {
    "organization_id": "00000000-0000-0000-0000-000000000000",
    "title": "Unencrypted laptop backups",
    "category": "Information Security",
    "likelihood": 3,
    "impact": 4,
    "owner": "Information Security Manager"
  }
}

`list_controls`

List controls

read-only

Lists controls implemented in a workspace (ISO 27001 Annex A, ISO 9001, ISO 42001, etc.) with reference, framework, status and owner.

Inputs

Name	Type	Required	Description
organization_id	uuid	yes	Workspace id.
framework	string (≤60)	no	e.g. 'ISO 27001'.
status	string (≤60)	no	Filter by control status.
limit	integer (1-500)	no	Max rows (default 100).

Example call

{
  "name": "list_controls",
  "arguments": {
    "organization_id": "00000000-0000-0000-0000-000000000000",
    "framework": "ISO 27001"
  }
}

`list_policies`

List policy documents

read-only

Lists policy documents in a workspace with standard, reference, title, status and version. Does not return the full policy body.

Inputs

Name	Type	Required	Description
organization_id	uuid	yes	Workspace id.
status	string (≤60)	no	e.g. 'draft', 'adopted'.
limit	integer (1-200)	no	Max rows (default 50).

Example call

{
  "name": "list_policies",
  "arguments": {
    "organization_id": "00000000-0000-0000-0000-000000000000",
    "status": "adopted"
  }
}

`list_assets`

List information assets

read-only

Lists information assets in a workspace (systems, data stores, suppliers, etc.) with type, owner and description.

Inputs

Name	Type	Required	Description
organization_id	uuid	yes	Workspace id.
limit	integer (1-500)	no	Max rows (default 100).

Example call

{
  "name": "list_assets",
  "arguments": {
    "organization_id": "00000000-0000-0000-0000-000000000000"
  }
}

`list_tasks`

List Statement of Applicability tasks

read-only

Lists open implementation tasks (SoA tasks) in a workspace with title, due date, status and owner. Useful for triaging what still needs to be done for certification.

Inputs

Name	Type	Required	Description
organization_id	uuid	yes	Workspace id.
status	string (≤60)	no	Filter by task status.
limit	integer (1-200)	no	Max rows (default 100).

Example call

{
  "name": "list_tasks",
  "arguments": {
    "organization_id": "00000000-0000-0000-0000-000000000000",
    "status": "open"
  }
}

Something missing? Email hello@iso-standard.app — we add new MCP tools regularly.