MCP Server

​

Overview

• Compliance — readiness scores, gaps, framework status
• Controls — list and inspect controls with implementation status
• Policies — browse policies, versions, approval status
• Tests — view test results, schedules, pass/fail status
• Risks — risk register entries with scores and ownership
• Evidence — collected evidence inventory
• Personnel — employee directory
• Vendors — vendor list with risk levels
• Integrations — connected integrations and sync status
• Training — course catalog and completion
• Tasks — compliance task assignments
• Incidents — security incident tracking

​

Authentication

​

Endpoint

POST https://mcp.lowerplane.com/api/v1/mcp

​

Setup

claude mcp add --transport http lowerplane https://mcp.lowerplane.com/api/v1/mcp \
  --header "Authorization: Bearer lp_live_your_api_key_here"

> What's our SOC 2 compliance score?
> Show me all failing tests
> List policies that need approval

{
  "mcpServers": {
    "lowerplane": {
      "transport": "http",
      "url": "https://mcp.lowerplane.com/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer lp_live_your_api_key_here"
      }
    }
  }
}

https://mcp.lowerplane.com/api/v1/mcp

​

Available Tools

​

Compliance & Dashboard

​

Controls

​

Policies

​

Tests & Monitoring

​

Risk Management

​

Evidence

​

Frameworks

​

Personnel

​

Vendors

​

Integrations

​

Training

​

Tasks

​

Incidents

​

Example Queries

• “What is our overall compliance readiness?”
• “Show me all controls that are not implemented for ISO 27001”
• “Which policies are still in draft status?”
• “List all critical and high severity test failures”
• “What are our top risks by score?”
• “Show vendors with high risk level”
• “Which training courses have low completion rates?”
• “List overdue compliance tasks”

​

Security & Permissions

• The MCP server provides read-only access to your compliance data
• All queries are scoped to your organization — no cross-tenant access is possible
• API key permissions from Settings > API Keys apply
• No compliance data is cached by the AI — it is retrieved fresh per request
• All MCP requests are logged in your organization’s audit trail