ISO 27001 AI MCPofficial
A
licenseNot graded
qualityC
maintenanceISO 27001 AI - MCP server providing AI-powered tools and automation by MEOK AI Labs
8 npm
44 PyPI
3
MIT
SOC2 Compliance AI MCP
Officialby CSOAI-ORG
This server provides SOC 2 Type I/II compliance tools for audit preparation, risk assessment, and control mapping.
Assess systems against all 5 Trust Service Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy)
Perform gap analysis between implemented controls and SOC 2 requirements with prioritized remediation plans
Generate SOC 2 control matrices with control objectives, activities, and evidence requirements
Conduct SOC 2 risk assessments mapping risks to specific control requirements, including AI-specific risk factors
Crosswalk SOC 2 controls to ISO 27001 Annex A for dual-compliance efforts
Generate readiness checklists for Type I or Type II audits based on organizational maturity and AI system presence
Operate as a read-only, stateless MCP server with deterministic outputs and no external data transmission
Soc2 Compliance Ai MCP
⚖️ Built by MEOK AI Labs / CSOAI. Need this applied to your system fast? Book a 30-min Founder Office Hour (£29) → https://meok.ai/work · Full governance platform → https://meok.ai
SOC 2 Type II compliance MCP — Trust Service Criteria audit, access review, change management, co... mcp-name: io.github.CSOAI-ORG/soc2-compliance-ai-mcp
SOC 2 Compliance MCP
SOC 2 Trust Service Criteria — Security, Availability, Processing Integrity, Confidentiality, Privacy
SOC 2 Type II compliance MCP — Trust Service Criteria audit, access review, change management, control evidence automation.
🚀 Quick Start
# Install via pip
pip install soc2_compliance_ai_mcp
# Or install via Smithery
npx -y @smithery/cli@latest install soc2-compliance-ai-mcp --client claudeRelated MCP server: EU AI Act Compliance MCP
✨ Features
MCP protocol compliant
Easy installation
Well-documented API
Production-ready
Active maintenance
📖 Documentation
🛡️ Compliance
This MCP server is built with EU AI Act compliance built-in:
✅ Article 9 — Risk Management System
✅ Article 13 — Transparency & Instructions for Use
✅ Article 15 — Bias Detection & Testing
✅ Article 26 — FRIA Support (where applicable)
✅ Article 50 — AI Content Watermarking (where applicable)
Need help getting compliant? Book a free 15-min diagnostic →
🏢 Enterprise
Need custom development, SLA guarantees, or white-label deployment?
Pro: $99/mo — Full MCP suite + EU AI Act tracking
Enterprise: $499/mo — Custom dev + SLA + Dedicated support
View Pricing → | Contact Sales →
🤝 Part of the MEOK Ecosystem
This server is part of the MEOK AI Labs ecosystem — 300+ MCP servers for sovereign AI governance.
Domain | Purpose |
EU AI Act compliance marketplace | |
AI safety & monitoring | |
Sovereign AI platform | |
Legacy modernization |
📜 License
MIT © CSOAI-ORG
Tools
Tool | Description | Parameters |
| Assess controls against all 5 TSC principles |
|
| Identify gaps between existing controls and SOC 2 |
|
| Generate a SOC 2 control matrix |
|
| Overall SOC 2 audit readiness score |
|
| Generate evidence checklist by principle |
|
| Prioritized remediation plan for gaps |
|
Installation
pip install mcpClaude Desktop / Cursor / VS Code / Windsurf
{
"mcpServers": {
"soc2-compliance": {
"command": "python",
"args": ["path/to/server.py"]
}
}
}Usage Examples
Assess security principle
{
"principle": "security",
"controls": ["firewall", "encryption", "access control", "no monitoring"]
}Generate control matrix
{
"principle": "availability",
"controls": ["redundant servers", "backup power", "DR plan"],
"evidence": ["uptime reports", "DR test results"]
}Pricing
Free: 10 assessments/day
Pro: $99/mo — unlimited assessments + matrices
Enterprise: $499/mo — full audit trail + readiness scoring
Built by MEOK AI Labs | meok.ai
💸 Try MEOK in 30 seconds — instant buy ladder
Tier | Price | What you get | Stripe |
Smoke test | £1 | Signed sample MCP-Hardening report + Article 50 PDF | |
Quick Kit | £9 | EU AI Act Article 50 implementation guide (C2PA + EU-Icon) | |
Founder Call | £29 | 30-min 1-on-1 with the founder |
Refundable. UK Stripe — VAT-clean. Builds on the 81-MCP MEOK fleet. Verify any signed report at https://meok.ai/verify.
Available Tools
6 toolsassess_trust_principlesA
Audit an AI system against the 5 SOC 2 Trust Service Criteria: Security (Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy. Returns compliance status per principle with AI-specific findings.
Args: system_description: Description of the AI system or service being assessed principles_in_scope: Which principles to assess (default all 5): ["CC", "A", "PI", "C", "P"] controls_implemented: Dict mapping criteria series to implemented controls, e.g. {"CC6": ["CC6.1", "CC6.2"]} caller: Caller identifier for rate limiting tier: Access tier (free/pro)
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Inputs: system_description (required), tier, caller, api_key, +2 more. Returns: result
control_gap_analysisA
Gap analysis against SOC 2 controls. Compares implemented controls to required criteria and produces a prioritized remediation plan.
Args: implemented_controls: List of implemented SOC 2 criteria IDs (e.g. ["CC1.1", "CC6.1", "A1.1"]) target_type: "type1" (point-in-time) or "type2" (period of time, requires operational evidence) principles_in_scope: Filter to specific principles ["CC", "A", "PI", "C", "P"] caller: Caller identifier for rate limiting tier: Access tier (free/pro)
Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Inputs: implemented_controls (required), tier, caller, api_key, +2 more. Returns: result
crosswalk_to_iso27001A
Map SOC 2 controls to ISO 27001 Annex A controls. Shows how SOC 2 compliance overlaps with ISO 27001 certification requirements, enabling organizations pursuing dual compliance to identify shared controls.
Args: soc2_series: Specific SOC 2 series to map (e.g. ["CC6", "CC7", "A1"]) focus_principle: Filter by principle: "all", "CC", "A", "PI", "C", or "P" caller: Caller identifier for rate limiting tier: Access tier (free/pro)
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Inputs: tier, caller, api_key, soc2_series, +1 more. Returns: result
generate_control_matrixA
Generate a SOC 2 control matrix with control objectives, criteria, control activities, and evidence requirements. Suitable for auditor preparation and internal control documentation.
Args: organization_name: Name of the organization principles_in_scope: Which principles to include (default all 5) include_evidence: Whether to include detailed evidence requirements caller: Caller identifier for rate limiting tier: Access tier (free/pro)
Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
Inputs: organization_name (required), tier, caller, api_key, +2 more. Returns: result
readiness_checklistA
SOC 2 Type I/II readiness assessment. Generates a comprehensive pre-audit checklist with timeline, resource requirements, and AI-specific considerations.
Args: audit_type: "type1" (point-in-time design) or "type2" (operating effectiveness over time) organization_maturity: "low", "moderate", or "high" — current security maturity ai_system: Whether the service includes AI/ML components current_certifications: Existing certifications that provide head start (e.g. ["ISO27001", "GDPR"]) caller: Caller identifier for rate limiting tier: Access tier (free/pro)
Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice.
Inputs: tier, caller, api_key, ai_system, +3 more. Returns: result
risk_assessmentA
SOC 2 risk assessment per AICPA guidelines. Identifies risks to Trust Service Criteria, assesses likelihood and impact, and maps to specific SOC 2 control requirements.
Args: system_description: Description of the service organization and its systems service_commitments: System Description service commitments (SLAs, security guarantees) known_risks: Already identified risks to evaluate ai_specific: Whether to include AI-specific risk factors caller: Caller identifier for rate limiting tier: Access tier (free/pro)
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool when you need to assess, audit, or verify compliance requirements. Ideal for gap analysis, readiness checks, and generating compliance documentation.
When NOT to use: Do not use as a substitute for qualified legal counsel. This tool provides technical compliance guidance, not legal advice. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
Inputs: system_description (required), service_commitments (required), tier, caller, +3 more. Returns: result
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
A4.7/5.0
Scored across 6 tools
Disambiguation5/5
Each tool targets a distinct compliance activity: assessment, gap analysis, crosswalk, matrix generation, checklist, and risk assessment. No overlap in purposes.
Naming Consistency4/5
All names use snake_case and are descriptive, but pattern varies: some start with verbs (assess, generate) while others start with nouns (control, crosswalk, readiness, risk). Minor inconsistency.
Tool Count5/5
Six tools cover the key facets of SOC 2 compliance without being excessive or insufficient. Each tool earns its place.
Completeness5/5
The tools span trust principle assessment, gap analysis, crosswalk to ISO, control documentation, readiness checklist, and risk assessment—comprehensive coverage for SOC 2 compliance analysis.
Maintenance
ActivityNo data
ResponsivenessOutdated data
Related MCP Connectors
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
AI governance MCP server for EU AI Act compliance and jurisdiction verification
AI agent security, MCP 2026 schema & graph audits, <250ms guardrails, and compliance dossiers
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
Related MCP Servers
- AlicenseAqualityCmaintenanceEU AI Act Compliance - MCP server providing AI-powered tools and automation by MEOK AI Labs113 npm1MIT
- AlicenseAqualityCmaintenanceISO 42001 AI - MCP server providing AI-powered tools and automation by MEOK AI Labs106 npm42 PyPI1MIT
- AlicenseAqualityCmaintenanceNIS2 Compliance - MCP server providing AI-powered tools and automation by MEOK AI Labs755 PyPIMIT