MCP interface
SimpleAct as a tool source for AI assistants via the Model Context Protocol: nine tools, one of which writes.
Through the Model Context Protocol (MCP), AI assistants can query your compliance data, for example "Which deadlines expire this month?" or "Which obligations are open for system X?". SimpleAct provides an MCP endpoint for this. It is deliberately narrow: eight tools read, one files a request in the AI intake, and none of them changes the inventory.
At a glance
- Included from
- Enterprise (like the integration API)
- Where in the app
- Endpoint /api/v1/mcp; access through an API key
- Output
- Answers in JSON-RPC format; every call in the audit log with source "mcp"
- API
- /api/v1/mcp
Connection
- Transport: Streamable HTTP, stateless, JSON-RPC 2.0 via POST. GET and DELETE answer 405.
- Header Accept: application/json, text/event-stream.
- Authentication only with an API key (X-API-Key or Authorization: Bearer sk_…), no browser session.
- Every tool needs the same permissions as the matching REST endpoint. Tools that combine several sources (such as deadlines_upcoming) leave out sources the key may not read and name them.
The nine tools
| Tool | What it returns |
|---|---|
| ai_systems_search | AI systems, filterable by risk class, status, category or name; compact, without contact data. |
| ai_system_get | Profile of one AI system with the latest risk assessment and open checklist items (depending on permissions). |
| obligations_open | Open obligations of one system with article reference, or, without a system, open actions across all visible systems. |
| deadlines_upcoming | Deadlines in the next 1–365 days, overdue included: data subject requests, 72-hour notifications, legal reviews, audit actions, RoPA reviews. |
| processing_records_search | Search the records of processing by name/purpose, status or legal basis; without responsible persons and contact data. |
| incidents_open | Open AI incidents and data breaches with the status of the 72-hour notification; without reporters, assignees and descriptions. |
| compliance_summary | Key figures as on the dashboard; with the compliance score if the key may read AI systems (0–100, capped at 49 with a prohibited practice). |
| ai_intake_status | Requests in the AI intake with status; reviewers see all, otherwise only the key’s own. |
| ai_intake_submit (writes) | Files a request in the AI intake. Adds nothing to the inventory: a person reviews and decides. |
Data minimisation: what an assistant reads goes to its provider
Answers are therefore deliberately sparse: natural persons only appear as a case reference with initials, free text is shortened, and contact data, reporters and assignees never leave SimpleAct. Still check whether using an external assistant is compatible with your data protection requirements, for example the DPA and third-country transfer at the assistant’s provider.
Security details
- Text fields in answers are stored data, not instructions. The tool descriptions point this out to the assistant explicitly.
- Passwords, API keys or personal contact data do not belong in ai_intake_submit.
- Every call is recorded in the audit log with the source "mcp".