iso27001-mcp

Turn Claude into an ISO 27001 compliance assistant — controls, risk register, policies, evidence tracking, SoA generation, and full audit workflows in one local encrypted MCP server.

▶ Live Interactive Demo · Guided First-Run Checklist → · Roadmap →

_{▶ Getting Started — watch on YouTube}

Why this exists

ISO 27001 compliance work is typically scattered across spreadsheets, Word docs, ticketing systems, and shared drives. Security teams and consultants spend more time chasing evidence and reformatting documents than actually improving security posture.

iso27001-mcp solves this by giving Claude a live, stateful ISMS — all 93 ISO 27001:2022 controls seeded and ready, a real risk register, policy and procedure generators, evidence tracking, audit workflows, and a Statement of Applicability, backed by an encrypted local database that never leaves your machine.

The difference from generating static documents: Claude can query, reason, and update across your entire ISMS in a single conversation. Ask it to run a gap assessment, identify which open risks are linked to unimplemented controls, generate the policies that close those gaps, and produce a remediation roadmap — all without switching tools.

Who it's for: Security teams · Compliance consultants · GRC engineers · Startups preparing for ISO 27001 · Internal audit functions

What Claude can do with it

Quick Start

Prerequisites

• Node.js 20.11.0+ — nodejs.org or nvm / Volta

Build tools are usually not needed. The package ships pre-built binaries for macOS (arm64 + x64), Windows (x64), and Linux (x64/glibc). Try npm install -g iso27001-mcp first — if it succeeds, you're done.

↳ If the install fails with a node-gyp error, expand for OS-specific fix

• macOS: xcode-select --install
• Ubuntu / Debian: sudo apt-get install build-essential python3
• Windows: Visual Studio Build Tools → "Desktop development with C++"

↳ If you get an EACCES permission error on macOS or Linux

Your Node.js was installed system-wide and npm install -g needs write access to a root-owned directory. Do not use sudo npm install -g — it causes other issues. Instead, install Node via nvm or Volta, which place Node in your home directory where no elevated permissions are required.

↳ If you get command not found on Windows after a successful install

The npm global bin directory (%APPDATA%\npm) may not be on your PATH yet. Open a new terminal window — the installer updates PATH for new sessions but not the one already open. If it still fails, add %APPDATA%\npm to your PATH manually in System Settings → Environment Variables.

Three commands to get running

npm install -g iso27001-mcp     # 1. install globally
iso27001-mcp init --yes         # 2. one-shot setup — all defaults, no prompts
                                #    (omit --yes to choose custom paths interactively)
iso27001-mcp doctor             # 3. verify everything is working

After running iso27001-mcp doctor you should see:

iso27001-mcp — health check
────────────────────────────────────────────────────────
✅  DB_ENCRYPTION_KEY      set (64 hex chars)
✅  HMAC_SECRET            set (64 hex chars)
✅  MCP_API_KEY            set (starts with iso27001_)
✅  Database file          /Users/you/.iso27001/isms.db
✅  Database accessible    opened and queried successfully
✅  Migrations             11/11 applied
✅  Controls seeded        93 ISO 27001:2022 controls
✅  Active API key         1 active key found
✅  Claude Desktop config  /Users/you/.../claude_desktop_config.json
✅  iso27001-mcp entry     present in mcpServers
✅  Database writable      read-write test passed
✅  Env vars in config     DB_ENCRYPTION_KEY, HMAC_SECRET, MCP_API_KEY all present
────────────────────────────────────────────────────────
  All 12 checks passed. Restart Claude Desktop if you just ran init.

Then restart Claude Desktop fully and you should see 56 tools in the tools panel.

macOS: press Cmd+Q to quit (clicking the red dot only closes the window — the server won't reload).
Windows: right-click the taskbar icon → Quit.

Tools not appearing after restart?

Check the MCP server log — Claude Desktop writes server stderr here:

macOS:   ~/Library/Logs/Claude/mcp-server-iso27001-mcp.log
Windows: %APPDATA%\Claude\Logs\mcp-server-iso27001-mcp.log

Common causes: wrong Node.js version loaded by Claude Desktop, missing DB_ENCRYPTION_KEY in the config, or a database path that doesn't exist yet. Run iso27001-mcp doctor in a fresh terminal for a guided diagnosis.

Switched Node versions with nvm or Volta? The absolute Node.js path baked into your Claude Desktop config at init time now points to a deleted binary. Re-run iso27001-mcp init — it will detect your current setup and update the path. Your existing database and API keys are preserved (the wizard aborts if your secrets file already exists and you run with --yes).

Five prompts to try first

"Read the iso27001://server/info resource to check the server is running."
"Run an ISO 27001 gap assessment for a 50-person SaaS company."
"Create a risk register for a startup using AWS, GitHub, Slack, and Google Workspace."
"Generate a Statement of Applicability for ISO 27001:2022."
"Create an Access Control Policy mapped to ISO 27001 controls."

Tool Categories

56 tools across 16 groups. All require an API key; minimum role is shown. Read-only lookups (single-record fetches, summaries) have been moved to MCP Resources (iso27001:// URIs) — they appear in Claude's resource panel, not the tools list.