How to connect Claude to ClearIMS through MCP: step by step

This guide connects an AI assistant to your ClearIMS ISMS through MCP (Model Context Protocol). It works with any MCP client that accepts a server address plus an access token sent as an authorisation header. Claude Code is shown as the example.

Read AI assistant access first for how access is controlled.

Why it matters

Connecting an assistant gives it access to ISMS information, so do it the controlled way: your own token, read-only unless you need more, and recorded in the audit trail. This is how you meet ISO 27001's access control, authentication and logging controls (Annex A 5.15, 5.17, 8.5 and 8.15) for AI use.

Before you start

• Two-factor authentication must be on for your ClearIMS account.
• An admin must have turned on AI assistant access for your organisation.
• A client that supports MCP over HTTP with a custom header, such as Claude Code.

Step 1: create a token

1. In ClearIMS, open AI assistant access.
2. Create a personal access token. Give it a name you'll recognise, such as "Claude Code, work laptop".
3. Choose read-only (the default) or read and write if you want the assistant to do everyday actions like logging an incident.
4. Copy the token now. It's shown once. Store it in a password manager, never in a shared file.

Step 2: add ClearIMS to your assistant

The server address is:

https://app.clearims.com/api/mcp

The token goes in an Authorization header as Bearer <your token>.

For Claude Code, run this in a terminal, replacing <your token>:

claude mcp add --transport http clearims https://app.clearims.com/api/mcp --header "Authorization: Bearer <your token>"

For other MCP clients, add an HTTP MCP server with the address above and the same header. Check your client's documentation for where custom headers go.

Step 3: test it

Ask something simple, such as "Give me an overview of my ISMS" or "Which tasks are overdue?". If you made a read-only token and ask the assistant to log an incident, it should be refused: that's the access control working.

What an auditor looks for

• Named tokens per person, not one shared token.
• Read-only unless there's a reason for write access.
• Tokens revoked for leavers, and old ones cleaned up.
• Assistant activity in the audit trail. Changes are marked "via AI assistant (MCP)".

Common mistakes, and how to keep it manageable

• Pasting the token into chat or a shared document. Treat it like a password.
• Using write access for browsing. Keep a read-only token for everyday questions.
• Keeping unused tokens. Revoke a token when you stop using a client; it stops working immediately.

How to do it in ClearIMS

1. Create the token on AI assistant access (step 1 above).
2. Add the server and header to your client (step 2).
3. Review your tokens from time to time on AI assistant access, and revoke any you no longer use.

What works today: MCP clients that accept a server address and an access token, such as Claude Code. Support for more assistants, including ChatGPT, is planned.

Related pages

• AI assistant access: how access is controlled.
• Account security: setting up two-factor authentication.
• Audit trail: reviewing what assistants did.