MCP server
Your AI agent,
now a pentester.
Connect Compliance Everywhere to your AI coding agent. Ask in plain English, and it runs the pentest, opens the fixes, and files the report as SOC 2 evidence, right where you work. Works with Claude Code, Cursor, Codex, Windsurf, VS Code and any MCP client.
Included in your plan, no extra cost.
What it can do
The whole loop, in your editor.
One conversation, start to finish, each step mapped to a real MCP tool.
- 01Launch a pentest on the branch you just pushed.
- 02Pull the findings straight into the chat.
- 03Open the fix as a pull request.
- 04Get the report, filed as SOC 2 evidence.
In your editor
Ask in plain English. It does the rest.
Tell Claude Code or Cursor what you want. It calls Compliance Everywhere, runs the work, and brings the results back, without leaving your editor.
A Claude Code terminal driving Compliance Everywhere over MCP. The user asks to fix the critical findings and get the report. The agent calls the Compliance Everywhere tools, opens the fix as a pull request, and returns a report with SOC 2 evidence. Install it in Claude Code with: claude mcp add --transport http compliance-everywhere https://mcp.complianceeverywhere.com/mcp
What you get
The same proof, where you already work.
Every finding the engine returns to your agent carries the same three things it files in the dashboard.
- 01The exact request that triggered it.
- 02A screen recording of the exploit.
- 03The diff that closes it, as a pull request if you allow it.
Frequently asked
Questions.
01What is MCP?
The Model Context Protocol, the standard way AI tools call outside services. We expose Compliance Everywhere over it, so your agent can drive a pentest, and the whole SOC 2, directly.
02Which tools work with it?
Claude Code, Cursor, Codex, Gemini, Windsurf, VS Code, and any MCP client.
03Does it cost extra?
No. It runs the same engine on the same plan. MCP is just a new way in.
04Is it safe to let an agent run this?
Yes. It is scoped to exactly what your token allows, and every run still follows your signed rules of engagement. Your editor asks before each tool call.
05Is the pentest MCP the same as the evidence MCP?
No. This one runs penetration tests. The evidence collector that files SOC 2 artifacts from your own machine is a separate, read-mostly program, described on its own page.
One line to connect.
Your agent takes it from there.
Paste the MCP install line into your editor, and ask it to pentest the branch you just pushed.