MCP server
The InfoPol MCP server
MCP is an open standard through which an AI assistant uses tools and data. The InfoPol MCP server lets your assistant read InfoPol data and propose changes that a person approves.
1.What it is
The InfoPol MCP server is an address on the web that your AI assistant connects to. It keeps no separate copy of your data: every request goes through InfoPol’s own permission checks, the same as a member of your team acting in the application.
A connection is bound to one organisation. Every write tool needs a human approval. The detailed limits (what the AI may and may not do) are on the AI page.
2.Connection details
https://infopol.ee/api/mcp- Transport
- Streamable HTTP
- Sign-in
- OAuth with your own InfoPol account, in the browser
- Scope
- One organisation, with the permissions of the user who created the connection
- Writes
- Every item needs a human approval
3.Before you connect
You need an InfoPol account and membership of the organisation (team) whose data the AI will work with.
MCP access is off by default. An organisation administrator turns it on in the organisation settings, under MCP access. While it is off, no assistant can connect.
4.Adding it to your AI assistant
Buttons and menu names in assistants change with the product and plan, so the steps here are generic. Look in the assistant’s own help for adding a custom MCP server or connector. Any assistant that supports remote MCP servers will do, for example Claude.
- Open your AI assistant’s settings and find where a custom MCP server or connector can be added.
- Enter the MCP server URL shown above.
- When the assistant opens a sign-in, sign in with your InfoPol account and grant access.
- Ask the assistant who you are in InfoPol. When the connection works, it answers with your name and organisation.
5.Tools
The server offers 149 tools, grouped by area. Which of them a given user may use depends on their permissions in InfoPol: the assistant asks with the get_capabilities tool.
Connection info
2 tools, 2 of them read-only
whoami get_capabilities
Tasks
6 tools, 2 of them read-only
list_tasks get_task create_task update_task link_task_to_document unlink_task_from_document
Documents
12 tools, 5 of them read-only
list_documents get_document get_document_quiz list_document_templates create_document_from_template create_protocol update_document_content archive_document link_document_to_control unlink_document_from_control list_document_read_requirements configure_document_read_requirement
Frameworks and controls
14 tools, 8 of them read-only
list_available_frameworks list_frameworks list_framework_requirements list_controls get_control get_framework_resolution_plan get_framework_tree get_statement_of_applicability draft_statement_of_applicability adopt_framework unadopt_framework materialize_controls fulfill_control resolve_control
Members and invitations
6 tools, 2 of them read-only
list_members list_invitations invite_member revoke_invitation remove_member update_member_role
Risks
17 tools, 2 of them read-only
list_risks get_risk create_risk update_risk delete_risk link_risk_to_process unlink_risk_from_process link_risk_to_asset unlink_risk_from_asset link_risk_to_control unlink_risk_from_control link_risk_to_org_unit unlink_risk_from_org_unit link_risk_to_job_role unlink_risk_from_job_role link_risk_to_vendor unlink_risk_from_vendor
Processes
11 tools, 2 of them read-only
list_processes get_process create_process update_process delete_process link_process_to_asset unlink_process_from_asset link_process_to_control unlink_process_from_control link_process_to_vendor unlink_process_from_vendor
Assets
9 tools, 2 of them read-only
list_assets get_asset create_asset update_asset delete_asset link_asset_to_control unlink_asset_from_control link_asset_to_vendor unlink_asset_from_vendor
Vendors
7 tools, 2 of them read-only
list_vendors get_vendor create_vendor update_vendor delete_vendor link_vendor_to_control unlink_vendor_from_control
Incidents
20 tools, 3 of them read-only
list_incidents get_incident list_incident_lessons create_incident add_incident_update create_incident_lesson update_incident_lesson draft_incident_lesson_document link_incident_to_control unlink_incident_from_control link_incident_to_document unlink_incident_from_document link_incident_to_risk unlink_incident_from_risk link_incident_to_process unlink_incident_from_process link_incident_to_asset unlink_incident_from_asset link_incident_to_vendor unlink_incident_from_vendor
Job roles
8 tools, 3 of them read-only
list_job_roles get_job_role get_job_role_document_url create_job_role update_job_role delete_job_role assign_job_role_member remove_job_role_member
Record of processing activities (GDPR)
8 tools, 4 of them read-only
list_processing_activities get_processing_activity get_data_protection_profile export_ropa create_processing_activity update_processing_activity archive_processing_activity set_data_protection_profile
Organisational units
7 tools, 2 of them read-only
list_org_units get_org_unit create_org_unit update_org_unit delete_org_unit assign_org_unit_member remove_org_unit_member
Training
5 tools, 3 of them read-only
list_quiz_templates list_quiz_campaigns get_quiz_campaign create_quiz_campaign assign_quiz_campaign_members
Recurring review
11 tools, 2 of them read-only
list_automations get_automation create_automation update_automation delete_automation activate_automation deactivate_automation link_automation_to_control unlink_automation_from_control set_vendor_review set_registry_review_frequency
Owners
1 tools, 0 of them read-only
assign_owner
Organisation context
2 tools, 1 of them read-only
get_agent_context set_agent_context
Audit log and quality gate
3 tools, 3 of them read-only
query_audit_log verify_audit_log_chain audit_setup
6.Frequently asked questions
- Connecting fails with an error that the organisation is not enabled. What do I do?
- MCP access is off for the organisation. Ask an administrator to turn it on in the organisation settings and try again.
- Why does a tool not work with my account?
- The assistant acts with your InfoPol permissions. A tool you have no permission to use refuses to run. The assistant can see which tools it may use with the get_capabilities tool.
Ready to connect?
Create an InfoPol account or sign in, and enable MCP access in your organisation.