This MCP server, “Iso 27001 Ai MCP,” is described as an ISO 27001–related AI Model Context Protocol (MCP) server. It is attributed to MEOK AI Labs and CSOAI. The published content lists 6 tools and includes topics such as AI governance, compliance, and regtech.
🛠️ Key Features
Model Context Protocol (MCP) server
Tooling surface: 6 tools
Focus area: ISO 27001 AI governance/compliance
Provided by MEOK AI Labs / CSOAI
🚀 Use Cases
AI governance and compliance workflows (ISO 27001 oriented)
Regtech and compliance use within agentic AI contexts
Agent-to-agent (A2A) scenarios referencing MCP and AI agents
⚡ Developer Benefits
MCP integration for model context workflows
Topic alignment for discovery: “ai-governance,” “compliance,” “claude,” “ai-agents”
Suitable for developers searching by governance/regtech keywords
⚠️ Limitations
Tool details are not included in the provided excerpt beyond the total tool count (6).
Built with 💜 by MEOK AI Labs · UK Companies House 16939677
mcp-name: io.github.CSOAI-ORG/iso-27001-ai-mcp
ISO 27001 AI MCP
ISO/IEC 27001:2022 compliance assessment for AI systems — 93 Annex A controls across 4 themes, ISO 27005 risk assessment, Statement of Applicability generation, incident classification, and ISO 42001 bridge.
What This Does
ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). Its Annex A contains 93 controls organized into 4 themes: Organizational (37 controls), People (8), Physical (14), and Technological (34). Certification requires demonstrating that your ISMS meets clauses 4–10 and that your Statement of Applicability (SoA) addresses all relevant controls.
For AI systems, ISO 27001 is foundational — but it needs extension. This server audits your ISMS against all 93 controls, performs ISO 27005 risk assessments with AI-specific threat scenarios, generates gap analyses with prioritized remediation roadmaps, produces SoAs, classifies security incidents, and bridges to ISO 42001 for AI-specific governance.
Quick Start
bash
npx meok-setup --pack governance
Tools
Tool
Description
Parameters
audit_isms
Audits your ISMS against all 93 Annex A controls. Returns per-theme compliance status (PASS/PARTIAL/FAIL), gap identification, critical gap flagging for high-priority controls (A.5.1, A.5.15, A.8.5, A.8.24, etc.), and certification readiness assessment.
Performs ISO 27005 information security risk assessment. Evaluates 10 AI-relevant threat categories (adversarial attacks, model theft, training data breach, supply chain compromise, insider threat, etc.), calculates likelihood × impact risk scores, and produces a treatment plan with specific Annex A control recommendations.
Compares your current controls to ISO 27001 requirements. Supports three targets: "full" (all 93 controls), "core" (critical subset), or "ai-focused" (AI-relevant controls only). Returns prioritized remediation roadmap in 3 phases: Critical (0–30 days), Standard (30–90 days), Remaining (90–180 days).
Maps ISO 27001 controls to ISO 42001 AI-specific requirements. Shows how existing ISMS controls extend to AI governance (model security, training data protection, AI incident management) and identifies where AI-specific controls are needed.
controls, focus_area
generate_soa
Generates a Statement of Applicability per clause 6.1.3(d). Documents all 93 controls as Implemented, Excluded (with justification), or Not Yet Addressed. Required artifact for ISO 27001 certification audits.
Use the audit_isms tool with:
organization_context: "AI startup with 150 employees building ML models for healthcare diagnostics. Uses AWS for infrastructure, processes patient data, has a small security team."
scope_description: "All AI systems, ML pipelines, patient data processing, cloud infrastructure, and development environments"
controls_implemented: ["A.5.1", "A.5.9", "A.5.12", "A.5.15", "A.5.24", "A.6.3", "A.8.5", "A.8.7", "A.8.8", "A.8.15", "A.8.24"]
Expected output: Overall coverage ~12% (11/93 controls). Critical gaps flagged in A.5.34 (PII protection), A.8.12 (data leakage prevention), A.8.25 (secure SDLC). Certification NOT ready — 82 gaps to address.
Assess risk for your ML pipeline
code
Use the risk_assessment tool with:
system_description: "Production ML pipeline processing financial data for fraud detection. Uses gradient boosting models trained on 10M+ transaction records. Served via REST API with 99.9% SLA."
assets: ["training data", "ML model weights", "feature store", "API keys", "model serving infrastructure", "customer transaction data"]
existing_controls: ["A.5.15", "A.8.5", "A.8.15", "A.8.24"]
Expected output: Risk register with 10 threat assessments. Highest risks: training data breach (likely × high = risk score 16), model theft (possible × critical = 20). Treatment plan recommends implementing A.8.12, A.8.16, A.5.12 for the highest-priority gaps.
Generate a gap analysis for AI-focused certification
code
Use the gap_analysis tool with:
current_controls: ["A.5.1", "A.5.2", "A.5.15", "A.5.24", "A.6.3", "A.8.5", "A.8.7", "A.8.15", "A.8.16", "A.8.24"]
target_certification: "ai-focused"
Use the incident_classification tool with:
incident_description: "Adversarial evasion attack detected on production fraud detection model. Attackers crafted transactions that bypassed ML model scoring. Approximately 200 fraudulent transactions processed before detection."
affected_assets: ["fraud detection model", "transaction processing system", "customer accounts"]
detection_method: "automated"
data_breach: false
ai_system_involved: true
Expected output: Severity HIGH (P1), AI incident category: adversarial attack. Immediate response: activate incident plan (A.5.24), contain model, preserve inference logs, assess model integrity. AI-specific controls: A.5.7, A.8.8, A.8.16.
