Drive every BrickGRC capability from Claude Desktop, ChatGPT, Cursor, or any MCP-compatible host. Your agent orchestrates the audit lifecycle: install templates, upload evidence, trigger scoring, export reports. BrickGRC's installed AI engine does the actual scoring server-side, under your audit log.
If you can do it in BrickGRC, your AI agent can do it through MCP. 52 tools covering the full audit lifecycle, from template install to final report.
List templates, install framework bricks (single or multi-framework), spin up new engagements, update them, close them. The agent owns the lifecycle.
Queue maturity-scoring jobs (BrickGRC's installed AI engine runs them server-side under your audit log and BYO key), fetch results, apply state transitions, override risk, snapshot gap analyses. Async jobs surface with explicit status.
Upload documents over the wire (path or base64), trigger AI auto-linking against controls, rescan the document set, read or replace content in place.
Final audit report, evidence bundle, gap-analysis snapshot, remediation snapshot. All returned as single-use signed download URLs, scoped to your engagement.
Build your own framework brick programmatically: create templates, state flows, transitions, controls. Compose them into engagements end-to-end.
Manage engagement projects, override risk scores, match employees to controls, suggest control statuses. The operational layer your agent needs to actually finish the audit.
MCP is the open standard for agent tool use, adopted by every major host. Connect once. Every MCP client connects to BrickGRC the same way.
Pick the flow that fits your team.
OAuth (recommended): sign in once through your normal BrickGRC login. Your agent gets scoped, revocable access.
Personal API key: mint a token in the app, paste it into your host's config. Static and simple.
A one-time consent flow through your normal BrickGRC login (Google, Microsoft, SAML, SSO and 2FA all work). Your agent gets a scoped, revocable token that respects your RBAC role.
app.brickgrc.com and go to API Keyszpl_ token (shown once, save it in a password manager)The same security model that protects your BrickGRC account protects every agent connection. Revoke a key, kill an agent.
Authorisation Code with S256 PKCE. No paste-your-key flow on supported hosts. Your agent runs through your real BrickGRC login.
Personal keys SHA-256 hashed; OAuth-issued keys AES-256-GCM encrypted server-side. Plaintext never touches disk.
Every agent action runs through the same RBAC permissions your user has in the UI. An agent can't escalate beyond what you can do.
Default 120 requests/min per key, tunable. Stops a runaway agent from burning your AI budget overnight.
Revoke a key in the BrickGRC UI; every active session for that key is cut within seconds, OAuth tokens included.
Frankfurt, like the rest of BrickGRC. No data leaves the EU. GDPR + Schrems II clean.
A full inventory of what your agent can call. Each tool is a thin wrapper around the same BrickGRC API your UI uses. Same RBAC, same audit log, same data.
It takes 60 seconds. Sign in to BrickGRC, connect through your AI host, and watch your agent run the full lifecycle, from brick install to final report.