AI Assistants Now Connect to ComplyFlow Through MCP

It is the last week of the month and the WHS report for the leadership team is due. On a property portfolio that means incidents by building, overdue inspection actions, cleaners, HVAC technicians, and security contractors with documents about to lapse, and a line on training. The numbers are all in the compliance system. Getting them out usually means four screens, three exports, and a spreadsheet that takes an afternoon.

Now the person writing that report can ask for it instead. Through MCP, a safety or facilities manager can type a question into ChatGPT, Claude, or Microsoft Copilot and get the answer from the live compliance record. This post explains the standard that makes it work, what is worth asking, what to agree before anyone connects, and, at the end, how it works in our product.

What Is MCP?

MCP, the Model Context Protocol, is an open-source standard for connecting AI applications to other systems. Using MCP, AI applications such as Claude or ChatGPT can connect to data sources and tools, so they can look up information and carry out tasks.¹ The project's own description compares it to a USB-C port: one standard plug in place of a different cable for every device.¹

Anthropic introduced MCP in November 2024 to replace one-off integrations with a single protocol. A system exposes its data through an MCP server, and an AI application, the MCP client, connects to that server.²

For a safety team the detail that matters is simpler. MCP is why one connection works across several assistants. You do not need a different integration for each AI tool your organisation uses, and you do not need to export anything for the assistant to read it.

Why Does a Safety Team Need an MCP Server?

Because the questions a safety team asks rarely fit one screen. Which contractors on a site are missing a document, which of them signed in this week, and which inspection actions they own are three lists in most systems. An assistant connected through MCP can read across them in one answer, and follow up when the first answer raises a second question.

It also keeps the answer close to the source. A report built from last Tuesday's export is already out of date. An assistant that reads the live record answers from what the system holds when you ask, and it can tell you which records it used.

What Can You Ask an AI Assistant About Your Compliance Record?

The questions that work best are the ones you would otherwise answer by filtering a list and exporting it. Three habits make them work: tell the assistant to use your compliance system rather than its general knowledge, name the site, the period, and the module, and ask for record IDs so every line can be checked. Some examples, from different workplaces:

• "Which cleaning and security contractors at the university campus are missing a document, and what is each one missing?"
• "Which inspection actions are overdue at the hospital, and when was each one due?"
• "What permits are active at the airport terminal this week, and which expire in the next 48 hours?"
• "Which electricians and HVAC technicians working across our government office blocks have a licence expiring in the next 30 days?"

Start broad, then drill in. "Which site has the most overdue actions?" followed by "Show me those actions, oldest first" gets further than one long question. The work that crosses screens is where an assistant earns its place: a site briefing pack before a pre-start, a toolbox talk built from the last quarter's incidents and inspection findings, or a supplier review grouped by site.

A Monthly WHS Report for a Property Portfolio, Asked For in One Message.

Take a facilities manager whose portfolio runs from commercial office towers in Parramatta to a regional hospital and a university campus. Cleaners, HVAC technicians, security officers, electricians, and lift and fire maintenance trades are on her sites every day. Each month the leadership team wants the same page: incidents by building against last month, overdue corrective and inspection actions, supplier compliance by building, training completion, and the risks that need attention.

Instead of building that by hand, she asks her assistant for it in one message: "Prepare a monthly WHS report for October for the leadership team. Include incidents by category and site, with a comparison to September; overdue corrective and inspection actions; supplier compliance by site; training completion; and the top five risks. Use headings and tables, and finish with three things that need attention."

Two habits make the answer safe to send. She asks for record IDs, so every line can be opened and checked at the source. And before the report goes anywhere, she opens the matching screens and confirms two or three headline figures, because assistants read long lists in pages and a total built from one page is short. If a number looks wrong, she asks the assistant how it counted it, and which records it left out.

What she keeps is the prompt. Saved and reused each month, the report becomes a question rather than a project, and the time goes on the three things that need attention.

What Is the Difference Between an API and MCP?

An API is the set of doors a system offers to other software, and someone has to write code to use each one. MCP is a standard way for an AI application to use those doors without a custom integration for every system: the system publishes an MCP server once, and any MCP client can connect to it.²

In practice, an API connection is something your IT team builds once for a fixed purpose. An MCP connection, once it is set up, lets a manager ask questions nobody planned for. That is why the controls matter more, not less.

What to Agree Before Your Team Connects an Assistant.

An assistant reading your compliance record is a new way into sensitive data, so treat it like any other access decision. Five things are worth settling first:

• Which assistant. Use the one your organisation has approved, under its agreement with the AI company. That agreement, not the compliance system, governs what the AI company may do with the questions and answers.
• Who gets access. Start with a small group that already answers these questions by hand, such as WHS managers and administrators, and widen it once the reports are trusted.
• Read before write. Begin with access that can look but not change. Decide separately, and later, whether anyone should be able to act through an assistant.
• How long access lasts. Short-lived access that has to be renewed is easier to govern than a standing connection nobody remembers creating.
• Who checks the numbers. Name the person who confirms headline figures before an AI-built report leaves the team.

Which AI Assistants Can Connect to ComplyFlow?

The MCP server sits between your assistant and your record, and reads through our Platform API using a personal API token you create.³ The Help Centre set-up guide covers Claude Desktop, Claude Code, and Microsoft Copilot. Today each runs a small server on your own computer, which needs Node.js 20 or later, so many teams will want IT alongside for the first connection.⁴ ChatGPT connects the same way, with a personal token.⁵

How ComplyFlow Keeps Access Within Your Permissions.

An assistant can never see more than the person who connected it: every request is checked against the token's scopes and that person's own module permissions and sites, and both must allow it.⁶ An administrator decides who can create a token, under Staff permissions, by ticking MCP / API token access.⁶ Each token is scoped to the modules you tick, so it is read-only if you want it to be; it expires after 30 days by default, or up to a year, and stops the moment it is revoked.⁵

To start, an administrator gives access, you create a token from API Tokens in your profile menu, connect your assistant, and ask: "Using ComplyFlow, who am I and what can I access?"⁷ The prompting tips carry report prompts, including four quarterly ones marked as tested, and the troubleshooting guide covers the limits and the common error messages.⁸

For the wider picture of where AI fits in a safety program, read our guide to AI for workplace safety, and for the habits that make AI output worth trusting, the five AI skills every WHS manager should be building. The AI Assistants page shows the feature alongside the rest of our AI features, and the property and facilities management page covers the record it reads.

Ask the Question, Then Check the Numbers.

The value is not that an assistant writes the report. It is that the person accountable for the numbers can get to them in a sentence, from the live record, and spend the saved afternoon on the actions the numbers point to.

Start with one recurring report, one small group, and a token with read scopes only. If you would like help setting it up, talk to our team about a set-up session.