SOC 2 today, ISO 27001 starting November 9. Your Claude, Cursor or any MCP agent builds the controls. Pentest and device management in house. An independent US CPA signs the report. $299 a month, all in from $7k a year.
This listing identifies a third-party MCP server. MCPBundles is not affiliated with, sponsored by, or endorsed by the service or its operator unless stated on this page.
This server may ask you to sign in when your AI client connects.
Last probed Nov 3, 2026 · mcp.complianceeverywhere.com
22tools discovered
For AI agents — MCPBundles Directory API
For MCP client apps (human connect):
MCP connect URL: https://mcp.complianceeverywhere.com/mcp
Skill page: https://www.mcpbundles.com/skills/complianceeverywhere-mcp-5104ddab81
Explore capabilities (22)
read 14
write 8
List
6
Get
5
Review
2
Other capabilities
9
List Workspaces
read
list_workspaces
List the workspaces you can access (owner or team member).
List Workspaces — List the workspaces you can access (owner or team member).
List Targets — List targets (products/domains in scope) across your workspaces, with
open-finding counts and last-op status.
Get Target — Get one target and its recent operations.
List Pentests — List pentest operations across your workspaces (most recent first).
Get Pentest — Get a pentest's live status + summary.
Includes the real pipeline `stage` right now (mapping / live attack /
writing up / correlating / generating fixes / writing report), and for a
running op: `elapsedSeconds` (how long it has been running; null once
finished) and `lastActivityAt` (heartbeat of the last engine event — a
stale one means it may be stuck). `humanReview` shows whether a human
security engineer reviews before the report ships (`gated`), whether it is
in that review now (`inReview`)
List Findings — List findings for a pentest. Each finding carries severity, triage status,
the evidence-ladder `stage`, the app-contextual `plain_title`, the computed
`cvss` ({vector, score, band}), the narrative (`explanation_md` / `repro_md`),
and the structured suggested fix (`fix.changes` = per-file diffs).
Pentest Coverage — What the pentest TRIED, in plain language, plus how to make the next run
better.
- `coverage`: the "what we tried" grouping — one entry per technique family
in the customer's own words (`plain_name`), each with an `outcome`
(blocked / needs_validation / not_applicable / errored / mixed). This is
the plain-language coverage, NOT a raw per-probe list.
- `notes`: actionable "Notes to make the pentest better next time" — concrete
levers (seed test accounts, authorize an in-scope backend, fi
Get Finding Steps — Get the reproduction steps / evidence trail for a finding.
Get Report Link
Get your MCP into directories
A working endpoint is step one. Directory coverage is the coordinated launch across ChatGPT, Claude, Cursor, the MCP Registry, and community indexes.
SOC 2 today, ISO 27001 starting November 9. Your Claude, Cursor or any MCP agent builds the controls. Pentest and device management in house. An independent US CPA signs the report. $299 a month, all in from $7k a year.
How do I connect Compliance Everywhere to my AI agent?
Use the MCP endpoint listed on this page in your MCP client configuration. One-click install pills support Claude, Cursor, VS Code, and other hosts. Copy the remote MCP URL if your client needs a manual entry.
Operate this server?
Request removal if you do not want Compliance Everywhere listed here, or claim the listing if you want to manage it on MCPBundles.
Operate Compliance Everywhere?
This server appears in the MCPBundles directory. Verify you operate it to take over the listing — name, description, logo, contact email, and skill content. We email a 6-digit code to a maintainer address your server publishes in /.well-known/security.txt or /.well-known/mcpbundles.json. Free, takes about a minute.
MCPBundles publishes this directory for MCP discovery. Except where we host or operate an offering, third-party services run under their own terms. Product and company names on this page are used in a descriptive, identifying way (including under nominative fair use where applicable); they remain the property of their owners. Nothing here grants you rights in those marks, and nothing here is an offer to sell a third party's services. Terms · Request removal
More in developer tools
Other MCP servers in this category from the directory index
— Return the dashboard URL to download a pentest's PDF report.
The report is a binary PDF gated on all findings being triaged; it is
downloaded from the dashboard rather than streamed through MCP.
Triage Finding — Set a finding's triage status.
- `fixed` / `false_positive` / `open`: no note required.
- `wont_fix`: a non-empty `note` is REQUIRED (it goes in the
accepted-risk register that auditors read).
Records who and when; reversible by calling again with a new status.
Open Fix Pr — Open a GitHub pull request for this finding's structured fix.
Idempotent — if a PR already exists it returns that one. Requires the
finding's pentest to have a linked GitHub repo and the fix to carry
code changes (not all findings do).
List Team Members — List your current workspace's team: members (with role, join date, and who
invited them) plus any pending invitations.
Start Replay — Replay a finding: re-run its exact recorded reproduction live in an
isolated sandbox and judge whether it still reproduces. Returns the replay
run (poll `get_replay` with its id for status + verdict). Experimental: an
`inconclusive` result (e.g. an expired captured credential, one-time state,
or rate-limiting) does NOT mean the finding is fixed. Not all findings are
replayable — check the finding's `replayable` flag first.
List Replays — List your past replay runs for a finding (newest first), each with its
verdict and outcome summary.
Get Replay — Get one replay run: status, current phase, verdict (reproduced /
not_reproduced / inconclusive), the plain-language outcome, and per-step
results. Poll this after `start_replay` until status is terminal
(done / error / cancelled).
Stop Replay — Stop an in-flight replay run.
Review Queue — [Reviewer] List pentests awaiting review that are assigned to you.
Review Operation — [Reviewer] Full review detail for a pentest: all findings (incl.
dismissed), attempts, briefing, and verdict state.
Set Finding Verdict — [Reviewer] Set the review verdict on a finding. A `reason` is
required for confirmed/false_positive (audit trail).
Dismiss Finding — [Reviewer] Dismiss a finding so it never ships in the report.
Undismiss Finding — [Reviewer] Restore a previously dismissed finding.
Finalize Review — [Reviewer] Finalize a review: lock it, generate the customer report,
and mark the pentest completed. All findings must have a verdict first.
How many tools does Compliance Everywhere provide?
MCPBundles probed 22 tools on the live server. The tool list on this page reflects what was discovered at the last refresh — connect your client to see the full set available to your session.
What authentication does Compliance Everywhere require?
Compliance Everywhere may require signing in to the provider before tools can run. Connect through MCPBundles or your MCP client and complete any provider login when prompted.
Don't want this listed?
Request removal from the MCPBundles directory. We stop publishing this listing on mcpbundles.com.
MCPBundles is an independent platform built on the open Model Context Protocol standard. MCPBundles is not affiliated with, sponsored by, or endorsed by Anthropic PBC.