Scytale‘s Model Context Protocol (MCP) server connects your AI tools directly to your compliance program, so it can query live data and complete manual work through plain language instead of screen-by-screen navigation.
Scytale’s MCP matches how AI-native teams increasingly operate, where your preferred AI tool is expected to pull the answer or do the task directly. Scytale’s MCP closes the gap of clicking into modules and exporting data to build a report, by making compliance data and workflows available to any AI tool a customer connects, with the same rigor and access controls as the platform itself.
What Scytale MCP does
Scytale MCP exposes Scytale as a first-class participant in a customer’s AI and agentic workflows. Any standard MCP-compliant client, such as Claude, ChatGPT or a customer’s own internal agent, can connect and query compliance data in real time to build reports, populate dashboards, or simply answer a question on demand.
You can simply connect Scytale’s connector to your Claude app, via Claude’s Settings –> Connectors. Once it’s connected, you can start asking any questions and pulling your compliance information from Scytale.
The rollout is deliberately staged, starting narrow and expanding as the standard matures:
Read: query compliance data across the platform
Live now, Scytale MCP exposes core compliance objects as read-only tools, including frameworks, audits, controls, monitoring, policies, risks, tasks, and vendors. Instead of pulling together a report by hand, teams can ask Claude, ChatGPT or another AI tool directly and get a live answer grounded in current data. Real examples this unlocks:
- How ready are we for our SOC 2 audit right now?
- Which controls are failing or still need evidence before the audit?
- What’s blocking our current audit?
- Which policies haven’t been signed yet, and by whom?
- What automated tests are currently failing?
Write: upload manual evidence (coming next)
The next phase adds a single, scoped write capability: an upload_evidence tool that lets an AI tool attach manual evidence to the right control or monitoring on a customer’s behalf, removing one of the most repetitive manual steps in day-to-day compliance work.
Always-on GRC. Built for modern teams.
Built with the same rigor as the rest of Scytale
Connecting an AI tool to compliance data only works if it’s trustworthy, so Scytale MCP is secure and scoped by design:
- Scoped access. Each connection authenticates via OAuth and is scoped to a single company, with no cross-account visibility.
- Read-only to start. Phase 1 makes no changes to underlying data. Every action available to a connected tool is a query, not a judgment call: there’s no closing controls, approving audits, or changing statuses.
- Fully audit-logged. Every call a tool makes is logged, so activity through MCP is as visible and accountable as activity through the UI.
- Regional by default. Scytale MCP is hosted per region, so a customer’s data stays in the same region it already lives in today.
- Client-agnostic. Scytale MCP is built to connect with any MCP-compliant client, including Claude, Claude Code and Desktop, ChatGPT, or a customer’s own agent, rather than a single AI provider.
Scytale MCP is the first step toward making compliance data as accessible to an AI tool as it is to the team that manages it.
