# kanonik

Wires your agent to the Kanonik service for policy and control work across ISO 27001, SOC 2, GDPR and HIPAA, with a verifier and human approval on every write.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: Kanonik-LLC
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Kanonik-LLC/kanonik-plugin
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/kanonik

## What it does

Kanonik hands the agent a typed compliance model plus a record of its actions that cannot be quietly edited. A server-side Verifier checks the output, and each write waits behind a human approval gate. Nothing lands in your record without a single-use signed token and a person clicking approve. The agent cannot sign off on its own work.

The plugin is one file naming where the MCP server lives. No bundled code, no install script, no hook, no local process — everything runs at Kanonik. Your client connects to `https://app.kanonik.ai/mcp` and a browser window opens for sign-in on first use. A Kanonik account is required.

Sign-in uses OAuth 2.1 with Dynamic Client Registration and PKCE against `https://auth.kanonik.ai`; tokens stay in your client. Scopes are `kanonik:read` for reading the record, `kanonik:propose` for drafts, `kanonik:commit` for submitting them. Kanonik holds no credentials to your source systems, so if the agent pulls from GitHub, Jira or your identity provider it uses its own connections. Network access goes to one endpoint only.

## Requirements
- Remote server: `https://app.kanonik.ai/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http kanonik https://app.kanonik.ai/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add kanonik --url https://app.kanonik.ai/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "kanonik": {
            "url": "https://app.kanonik.ai/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "kanonik": {
            "type": "http",
            "url": "https://app.kanonik.ai/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http kanonik https://app.kanonik.ai/mcp
```

## When to use it
- produce a Statement of Applicability against a loaded framework
- spot the gaps between framework requirements and what you already run
- attach evidence to every judgement about an internal control
- build an audit trail an assessor can verify on their own
- revise policies and procedures for ISO 27001:2022 or SOC 2

## Example prompts
- Draft a Statement of Applicability for ISO 27001:2022 from my workspace
- Assess our internal controls and record the evidence behind each call
- Find where our GDPR coverage falls short of the framework

## Similar
- [compliance-specialist](https://affpapa.org/en/nevibecode/agents/compliance-specialist.md) — subagent · 1052 installs
- [ai-change-evidence](https://affpapa.org/en/nevibecode/skills/ai-change-evidence.md) — skill · 334 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [security-compliance-audit](https://affpapa.org/en/nevibecode/skills/security-compliance-audit.md) — skill · 665 installs
- [soc2-compliance](https://affpapa.org/en/nevibecode/skills/soc2-compliance.md) — skill · 658 installs
- [dd-audit-compliance-report](https://affpapa.org/en/nevibecode/skills/dd-audit-compliance-report.md) — skill · 477 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md