What is the ComplyFlow MCP Server?
The ComplyFlow MCP Server lets you connect AI assistants — such as Claude, Claude Code and GitHub Copilot — to your ComplyFlow data. MCP (Model Context Protocol) is an open standard that allows AI tools to securely access information from other systems. Once connected, you can ask your AI assistant questions about your compliance data in plain English and receive answers drawn directly from your ComplyFlow account.
The MCP Server reads data through the ComplyFlow Platform API using a scoped API Token that you create in ComplyFlow. It does not bypass ComplyFlow security: every request is checked against your permissions, your Site assignments and the scopes you granted the token.
Access is read only. AI assistants connected through the MCP Server can look up and summarise your data, but they cannot create, change or delete anything in ComplyFlow.
What can it be used for?
Once connected, your AI assistant can answer questions across the modules you have granted access to, for example:
Incidents — "Summarise the incidents reported at our Western Sydney sites last month"
Inspections — "Which inspection actions are overdue, and who is responsible for them?"
Suppliers/Contractors — "Which contractors at Site X have expired insurance documents?"
Workers — "List the workers on site whose licences expire in the next 30 days"
Risk Register — "What are our highest-rated risks and what controls are in place?"
Plant & Equipment — "Show me plant items with overdue service dates"
Sites — "Which contractors are currently engaged at the Albany Warehouse?"
Permits — "What permits are active this week?"
Because the assistant can combine information across modules, it is particularly useful for preparing reports, briefing packs, toolbox talks and compliance summaries that would otherwise require checking several screens.
How access is kept secure
Access through the MCP Server is governed by four layers of protection:
API Token — you authenticate with a personal API Token created in ComplyFlow. Tokens can be set to expire and can be revoked at any time
Scopes — each token only has access to the modules (scopes) you select when creating it, e.g.
incidents:readorsites:readYour permissions — a token can never see more than you can. It inherits your Staff User permissions and Site assignments, so if you cannot view a module or Site in ComplyFlow, neither can your token
Organisation isolation — tokens only access data within your own organisation
Refer to Creating an API Token and Managing Scopes for details on tokens and permissions.
What you need to get started
A ComplyFlow Staff User account with permission to view the modules you want to query
An API Token created in ComplyFlow with the scopes you need
An MCP-compatible AI tool, such as Claude Code, Claude Desktop or GitHub Copilot in VS Code
Refer to Connecting ComplyFlow to Claude Code or GitHub Copilot for step-by-step setup instructions.
Related guides
Refer to Creating an API Token and Managing Scopes — create a token, choose scopes and understand how permissions apply
Refer to Connecting ComplyFlow to Claude Code or GitHub Copilot — connect your AI assistant step by step
Refer to MCP Access — all guides in this section
Refer to API Documentation — if you want to build your own integration against the ComplyFlow APIs directly