iso27001-mcp — Claude Code MCP server: what it does, how to install
Connects an encrypted ISO 27001:2022 ISMS database to your agent. It tracks risks, drafts mandatory policies, and prepares audit evidence locally without spreadsheets.
claude mcp add --env DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> --env HMAC_SECRET=<HMAC_SECRET> --env MCP_API_KEY=<MCP_API_KEY> --env DB_PATH=<DB_PATH> --transport stdio iso27001-mcp -- npx -y iso27001-mcpWhat iso27001-mcp does
The server turns your coding assistant into an information security workspace. It preloads all 93 controls from the ISO 27001:2022 standard into an encrypted SQLite file on your machine. Through 56 exposed tools, the agent can evaluate gaps, map untreated risks to controls, and produce required documentation.
All records stay on your local disk in isms.db. Running iso27001-mcp init builds the database and generates necessary credentials. You can inspect the entire setup at any time with the iso27001-mcp doctor command.
Without Node.js 20.11.0 or newer, the package will not run. Precompiled binaries handle macOS, Windows, and Linux installations directly. A C++ compiler is only needed if node-gyp triggers a fallback build during installation.
What it helps with
- track security risks in a local encrypted database
- generate a Statement of Applicability for 93 controls
- write compliance policies mapped to standard clauses
- plan internal audits and record corrective actions
Example prompts for the agent
- Build a risk register for our infrastructure on AWS, GitHub, and Slack.
- Draft an access control policy covering relevant ISO 27001 requirements.
- Prepare an internal audit checklist for clause 9.1.
How to install iso27001-mcp
Platform CLI
claude mcp add --env DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> --env HMAC_SECRET=<HMAC_SECRET> --env MCP_API_KEY=<MCP_API_KEY> --env DB_PATH=<DB_PATH> --transport stdio iso27001-mcp -- npx -y iso27001-mcpReplace <…> with your own values
Platform CLI
codex mcp add iso27001-mcp --env DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> --env HMAC_SECRET=<HMAC_SECRET> --env MCP_API_KEY=<MCP_API_KEY> --env DB_PATH=<DB_PATH> -- npx -y iso27001-mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"iso27001-mcp": {
"command": "npx",
"args": [
"-y",
"iso27001-mcp"
],
"env": {
"DB_ENCRYPTION_KEY": "<DB_ENCRYPTION_KEY>",
"HMAC_SECRET": "<HMAC_SECRET>",
"MCP_API_KEY": "<MCP_API_KEY>",
"DB_PATH": "<DB_PATH>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"iso27001-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"iso27001-mcp"
],
"env": {
"DB_ENCRYPTION_KEY": "<DB_ENCRYPTION_KEY>",
"HMAC_SECRET": "<HMAC_SECRET>",
"MCP_API_KEY": "<MCP_API_KEY>",
"DB_PATH": "<DB_PATH>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> -e HMAC_SECRET=<HMAC_SECRET> -e MCP_API_KEY=<MCP_API_KEY> -e DB_PATH=<DB_PATH> iso27001-mcp npx -y iso27001-mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about iso27001-mcp
How to install iso27001-mcp in Claude Code?
Run `claude mcp add iso27001-mcp -e DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> -e HMAC_SECRET=<HMAC_SECRET> -e MCP_API_KEY=<MCP_API_KEY> -- npx -y iso27001-mcp`. Replace placeholder values with keys generated during initial setup.
What does iso27001-mcp do?
It provides 56 tools for compliance workflows, including risk management, policy drafting, and Statement of Applicability generation. All records remain inside an encrypted local database.
What are the prerequisites for running iso27001-mcp?
You need Node.js version 20.11.0 or higher. The server also requires DB_ENCRYPTION_KEY, HMAC_SECRET, and MCP_API_KEY defined in the environment.
