# iso27001-mcp

Connects an encrypted ISO 27001:2022 ISMS database to your agent. It tracks risks, drafts mandatory policies, and prepares audit evidence locally without spreadsheets.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 35
- Author: Sushegaad
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Sushegaad/MCP-Server-for-ISO27001
- Updated: 2026-09-05
- HTML: https://affpapa.org/en/nevibecode/mcp/iso27001-mcp

## What it does

The server turns your coding assistant into an information security workspace. It preloads all 93 controls from the ISO 27001:2022 standard into an encrypted SQLite file on your machine. Through 56 exposed tools, the agent can evaluate gaps, map untreated risks to controls, and produce required documentation.

All records stay on your local disk in `isms.db`. Running `iso27001-mcp init` builds the database and generates necessary credentials. You can inspect the entire setup at any time with the `iso27001-mcp doctor` command.

Without Node.js 20.11.0 or newer, the package will not run. Precompiled binaries handle macOS, Windows, and Linux installations directly. A C++ compiler is only needed if `node-gyp` triggers a fallback build during installation.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `DB_ENCRYPTION_KEY`, `HMAC_SECRET`, `MCP_API_KEY`, `DB_PATH` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> --env HMAC_SECRET=<HMAC_SECRET> --env MCP_API_KEY=<MCP_API_KEY> --env DB_PATH=<DB_PATH> --transport stdio iso27001-mcp -- npx -y iso27001-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add iso27001-mcp --env DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> --env HMAC_SECRET=<HMAC_SECRET> --env MCP_API_KEY=<MCP_API_KEY> --env DB_PATH=<DB_PATH> -- npx -y iso27001-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "iso27001-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "iso27001-mcp"
            ],
            "env": {
                "DB_ENCRYPTION_KEY": "<DB_ENCRYPTION_KEY>",
                "HMAC_SECRET": "<HMAC_SECRET>",
                "MCP_API_KEY": "<MCP_API_KEY>",
                "DB_PATH": "<DB_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "iso27001-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "iso27001-mcp"
            ],
            "env": {
                "DB_ENCRYPTION_KEY": "<DB_ENCRYPTION_KEY>",
                "HMAC_SECRET": "<HMAC_SECRET>",
                "MCP_API_KEY": "<MCP_API_KEY>",
                "DB_PATH": "<DB_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e DB_ENCRYPTION_KEY=<DB_ENCRYPTION_KEY> -e HMAC_SECRET=<HMAC_SECRET> -e MCP_API_KEY=<MCP_API_KEY> -e DB_PATH=<DB_PATH> iso27001-mcp npx -y iso27001-mcp
```
Replace <…> with your own values

## When to use it
- track security risks in a local encrypted database
- generate a Statement of Applicability for 93 controls
- write compliance policies mapped to standard clauses
- plan internal audits and record corrective actions

## Example prompts
- Build a risk register for our infrastructure on AWS, GitHub, and Slack.
- Draft an access control policy covering relevant ISO 27001 requirements.
- Prepare an internal audit checklist for clause 9.1.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md