audit_ismsLABSCO SUMMARY
A control checklist that knows about model theft.
The value is the AI extension rather than the checklist. ISO 27001 was written for information systems, and the threats that matter for a model — adversarial evasion, poisoned training data, weights walking out the door — have to be mapped onto Annex A by someone. This does that mapping and produces the artifacts an audit asks for, chiefly the Statement of Applicability and a phased remediation roadmap. It scores what you tell it you have implemented, so it is a second reading of your control list, not evidence.
What it is
An MCP server for ISO/IEC 27001:2022 work on AI systems. Annex A's 93 controls span four themes — Organizational (37), People (8), Physical (14) and Technological (34) — and the server scores an ISMS against all of them, then extends into ground the standard does not cover directly: adversarial attacks, model theft, training-data breach and supply-chain compromise as threat scenarios, plus a crosswalk into ISO 42001.
What you get
- Per-theme compliance status across all 93 Annex A controls, with gaps identified, critical controls flagged and a certification-readiness verdict —
audit_isms - An ISO 27005 risk assessment over 10 AI-relevant threat categories, scored as likelihood against impact, with a treatment plan naming specific Annex A controls —
risk_assessment - A gap analysis against a full, core or ai-focused target, returning a prioritised roadmap in three phases: critical, standard and remaining —
gap_analysis - A Statement of Applicability per clause 6.1.3(d), documenting every control as implemented, excluded with a justification, or not yet addressed —
generate_soa - Incident classification against controls A.5.24–A.5.28: severity, priority, notification requirements and response steps, including AI categories such as data poisoning and prompt injection —
incident_classification - A mapping from the ISMS controls you already hold to ISO 42001 AI-governance requirements, showing where AI-specific controls are still needed —
crosswalk_to_ai
Requirements
No account and no key. It is published as the PyPI package iso-27001-ai-mcp 1.0.14, run over stdio with a Python runtime. The README's client entries launch it through npx under a package name npm does not have. The PyPI package's own command is iso_27001_ai_mcp, which a client can start with uvx --from iso-27001-ai-mcp iso_27001_ai_mcp. Everything the tools score comes from what you pass in — organization context, scope description, the controls you list as implemented — so the output is a structured reading of your own control list, not an inspection of your systems.
Setup effort
One command — pip install iso_27001_ai_mcp
USE CASES
01
Finding out how far from certification you are
Pass the organization context, the scope and the controls already in place, and read back per-theme status with the critical gaps flagged.
02
Producing the Statement of Applicability
Generate the clause 6.1.3(d) artifact with every control marked implemented, excluded with a justification, or not yet addressed.
03
Risk-assessing an ML pipeline
Describe the system and its assets and get a risk register over AI-relevant threats, with a treatment plan naming the controls to add.
04
Triaging a security incident involving a model
Describe what happened and get severity, priority, notification requirements and the controls the response should invoke.
05
Extending an existing ISMS to AI governance
Map the controls you already run onto ISO 42001 requirements to see which AI-specific gaps remain.
6 tools
Listed in project docs. Your client may show a different list.
risk_assessmentgap_analysiscrosswalk_to_aigenerate_soaincident_classificationBEFORE YOU INSTALL
What to know first
Tools you get
6 tools named in the project's documentation.
INSTALLATION
Connect your client
Add the block to your client, or run the command directly.
Server setup
Configuration file
JSON
{
"mcpServers": {
"iso-27001-ai": {
"command": "uvx",
"args": [
"--from",
"iso-27001-ai-mcp",
"iso_27001_ai_mcp"
]
}
}
}pip
TERMINAL
pip install iso_27001_ai_mcpThe package's command is iso_27001_ai_mcp. The client configuration runs it through uvx, so the pip install is only needed if you want to start it yourself.
