Verify the API key and return the connected Keel organization as {"org":{"id","name","tier"}}, where "tier" is the plan (free / starter / pro / enterprise / msp). Use this first to confirm which workspace you are acting on.

List the workspace security controls. Each item has "id", "key", "name", "description", "state", "ownerEmail" and "ownerName". Note the status field is named "state", and its values are not_started / in_progress / implemented / gap / not_applicable.

Get the audit-readiness summary for ISO/IEC 27001:2022 — this endpoint covers that framework only, not whichever framework the workspace has applied. Returns "framework", "version", "readiness" (percent, integer), "total", "applicable", "covered", "inProgress", "gap", "unaddressed" and "notApplicable".

List the workspace compliance tasks. Each item has "id", "title", "description", "status" (open / in_progress / done), "dueAt", "createdAt", "relatedEntityType" and the assignee as "assigneeId" / "assigneeName" / "assigneeEmail".

Create a compliance task in the workspace. Returns the new task id. Note: an unparseable dueAt is silently ignored by the API and the task is created without a due date, so send a valid ISO-8601 value or omit it.

List the workspace risk register. Each item has "id", "title", "description", "category", "likelihood", "impact", "inherentScore", "treatment", "residualLikelihood", "residualImpact", "residualScore", "status", "owner", "ownerEmail", "level" (low / medium / high), "mitigatingControls" and "implementedControls". Sorted by status first (open before closed), then level, then score — so an open low risk appears above a closed high one.

Add a risk to the workspace risk register. Returns the new risk id. Likelihood and impact are on a 1-5 scale.

List the third-party vendors tracked in the workspace, with "id", "name", "website", "contactEmail", "tier", "inherentTier", "residualTier", "status", "dataAccess", "notes", "lastReviewedAt" and "reviewDue".

Add a vendor to the workspace vendor register. Returns the new vendor id and tier.

List the workspace personnel directory, with "id", "source", "externalId", "email", "fullName", "jobTitle", "department", "groups", "managerEmail", "status" and "lastSyncedAt".

Add a person to the workspace directory, or update them if the email already exists. Idempotent: the response includes "created" (true for a new record, false for an update). Only manually-created records are updated — a person synced from an identity provider is returned unchanged.

List the workspace policies, with "id", "key", "title", "status", "version", "updatedAt", "approvedAt", "reviewDue" and "ownerMembershipId".

Create a policy from Markdown. Returns the new policy id, key and title. The key is derived from the title when not supplied; a policy is identified by its key, so reusing a key targets the existing policy.

List collected evidence, with "id", "type" (file / link), "title", "description", "filename", "sizeBytes", "contentType", "url", "collectedAt" and "expiresAt".

Attach a URL as evidence, optionally against a control. This tool covers link evidence only — uploading a file is a multipart request the REST API supports but this stdio server does not, so use the Keel app or the REST API directly for file evidence.

List the workspace webhook subscriptions, with "id", "targetUrl", "event" and "createdVia". The signing secret is never returned.

Subscribe a target URL to Keel events. Use event "all" to receive every event. The URL must be a public HTTPS endpoint — the API rejects http://, localhost and private network addresses.

Delete a webhook subscription by id. Idempotent — deleting an id that does not exist also succeeds, so a success result does not prove a subscription was removed. Call keel_list_webhooks to confirm.