How the evidence collector actually works.

A SOC 2 auditor does not want a screenshot. They want to know what was run, on what, when, by whom, and whether they can run it again and get the same answer. This page describes the program that produces that record, including the places where our guarantees stop.

This is not our penetration testing MCP. That one is at /product/mcp and it does a different job.

What it is

A small Node program that your coding assistant runs on your own machine, published as @complianceeverywhere/mcp. It has one dependency, the Model Context Protocol SDK. It ships with no knowledge of SOC 2: it asks our server at startup what the controls are, what your company runs, and what is still missing, and everything it knows comes from that call.

Your assistant then proposes a command that would satisfy a control, runs it against systems you are already logged in to, and files the result. You never paste a cloud credential into Compliance Everywhere, because the commands run where your credentials already are.

Installing it

Generate a key in the dashboard, paste one line, restart your editor. The key is shown once and stored as a hash, so we cannot recover it for you.

claude mcp add compliance-everywhere -- npx -y @complianceeverywhere/mcp@latest --token hz_pat_YOUR_KEY

Cursor and Codex take the same command through their own config files. The token can also come from a COMPLIANCE_EVERYWHERE_TOKEN environment variable (the older HACKZERO_TOKEN also works) if you would rather not have it in a config file.

What lands on one piece of evidence

This is the part that matters to your auditor. Every collected artifact carries all of it, and the server refuses the upload outright if the command or the exit code is missing.

source_command: The command, in full, never truncated. Refused if absent.
output: Everything it printed, byte for byte, encrypted at rest.
exit_code: Whether it succeeded. Refused if absent.
executed_at: When your machine ran it.
uploaded_at: When our server received it. Set by us, never accepted from a caller.
sha256: Computed by our server over the bytes we store, and compared to yours.
uploaded_by: The account behind the key.
uploaded_by_token: Which key. Both resolved server-side, never self-reported.
host, cwd, tool_version: Which machine, which directory, which client version.
system: Which of your systems this proves.

Output is stored exactly as captured. We do not truncate it and we do not edit it: an artifact over 8 MB is refused, with a message asking for a narrower command, rather than being silently cut. There is no redaction pass, deliberately. A secret scrubber over an open set of credential formats buys the appearance of safety rather than safety, and editing the bytes would destroy the one property that makes the artifact worth having.

Two timestamps are kept separately on purpose. Your machine says when the command ran; our server records when it arrived, and will not accept that value from a caller. An artifact cannot be backdated.

Everything it can do

Reads: nothing changes

soc2_status: Where you are, what is due, what is blocking each control.
soc2_coverage: Which parts of your observation window a control has evidence for.
soc2_read_control: One control: what it accepts, what is on file, what is still missing.
soc2_read_document: Reads a policy back, with its signature state and any blanks.
soc2_recommend_connectors: Which integrations matter for your stack, and which you can ignore.
soc2_open_questions: The setup questions still unanswered.
soc2_check_tool: Checks whether a CLI exists on your machine. Never leaves it.

Writes: these change your workspace

soc2_collect: Runs one command and files its output as evidence. The main one.
soc2_record_attempt: Records a command that failed, as an obstacle rather than a finding.
soc2_add_systems: Proposes the infrastructure in scope. Marked proposed until you confirm.
soc2_add_vendors: Proposes the third parties you use. Also proposed until confirmed.
soc2_add_people: Proposes your roster: names, emails, roles, start dates.
soc2_invite_people: Sends real email to real people. Refuses until it has shown you the list.
soc2_draft: Writes a policy. It cannot sign one.
soc2_edit_document: Changes a policy, including a signed one, which makes the signature stale.
soc2_fill_control: Fills the structured tables a control asks for.
soc2_answer: Records answers to setup questions, tagged as coming from the agent.
soc2_accounts: Records who can sign in to which system.
soc2_claim_account: Attaches a login to a person.

It cannot sign a policy. Signing happens in a browser, by a named person, and no key can do it. It cannot mark a system as internet-facing, because that is something a connector observed rather than something an agent may assert. Six controls are declared uncollectable and no command may touch them: the penetration test, the incident response exercise, security training, the access review, the management review meeting, and the backup restore test. Those have to actually happen.

The key, and what a stolen one could do

A 256-bit token, stored as a SHA-256 hash, pinned to one workspace, expiring after a year. It carries two scopes and can never reach the penetration testing side of the product, in either direction. Every write, every denial and every sensitive read is logged with the account, the key, the method, the path, the address and the agent.

Assume it leaks. It could read your whole compliance workspace, download the complete audit packet, create and edit your registers and policies, and email your team. It could not touch another customer, and it could not reach a pentest, a finding or a report. Treat it as you would a read-write API key for your compliance data, because that is what it is. Revoke it in the dashboard and it stops working immediately.

Where our guarantees stop

Four things worth knowing before you install it. We would rather you read them here than discover them later.

Read-only is an instruction, not an enforced boundary. We tell the assistant to propose only read-only commands, and the client runs the exact string it is given so that the recorded command and the executed command can never differ. There is no allowlist. If you want a hard boundary, run it under an account whose permissions are the boundary.
The confirmation prompt is your editor's, not ours. Claude Code, Cursor and the rest ask you to approve each tool call. That is a real and good control, and it belongs to your editor, so it follows whatever you have configured there, including turning it off.
Collected output is read by a large language model. When an artifact arrives we grade it against the control's criteria and tell you whether an auditor would accept it. That grading sends the beginning of the artifact to a third-party model provider. If a command's output would contain something you are not willing to send to a model, do not collect it that way. Upload it instead, or ask us and we will turn grading off for your workspace.
Your code does not reach us. It may still reach your model. Nothing sends your repository to Compliance Everywhere. But the assistant reading it is your editor's, talking to your editor's model, under your editor's terms. That is worth being precise about rather than letting our sentence imply more than it means.

On which commands to run

We are often asked for the list of commands to run each quarter. There is not one, and we would rather say so than invent it.

What the platform declares, per control, is what evidence would satisfy it, whose job it is, what is still missing by name, and how often it has to be refreshed. The assistant composes a command from that and from your actual stack, because the command for "prove every datastore encrypts at rest" is different on Supabase, on RDS and on a Postgres you run yourself. A fixed library would be wrong for most customers on most controls.

What you get instead is stronger for an audit: the exact command is recorded on every artifact, and every one of them can be re-performed by your auditor. The command set is not a controlled inventory we can hand over in advance. Every command we actually ran is.

On timing: evidence collected by command refreshes every 90 days, dated from when the command ran rather than when it was uploaded. Controls the matrix marks annual stay annual.

Questions

Does my source code reach Compliance Everywhere?

No. The agent reads your repository using your editor's own file tools, and only the command output you see is sent to us. Note that your editor is separately sending your code to whichever model you have configured, which is a matter between you and your editor.

Can it run something destructive?

We ask the assistant for read-only commands, and the client records and executes the exact string it is given. There is no allowlist enforcing that. Your editor prompts before each run, which is the real control, and it is your editor's prompt, not ours.

Can an auditor re-run what it collected?

Yes. Every artifact carries the full command, the exit code, when it ran and on which machine. That is the point of recording the command rather than a screenshot.

Where is the evidence stored?

Encrypted at rest in your workspace. An artifact over 8 MB is refused rather than cut.

Something here not precise enough for your review? Ask us and we will answer from the source, or change the source.