Skip to main content
Help Centre Support Contact
Partners
Create Free Account
Create Free Account Book a Demo

AI in ComplyFlow

AI Assistants via MCP: Ask Your Record, Skip the Report.

Which sites reported incidents this month? Who is on site with an expired licence? Ask ChatGPT, Claude, or Copilot and the answer comes from your live record, within your token’s scopes and your own permissions. Read-only if you want it to be.

Book a Demo Read the MCP Guide
  • Safety & HSE
  • IT & Data
  • Operations
  • Executive
Scoped tokens, read-only if you want, expiring within a year

The Answer in Seconds, From the Live Record, Within Your Permissions.

The Model Context Protocol is an open standard that lets an AI assistant connect to another system safely. ComplyFlow ships an MCP server, so ChatGPT, Claude, Claude Code, GitHub Copilot, or any assistant that speaks MCP can work with your record through a token you create: incidents, inspections, Workers, risks, plant, sites, and permits. Give the token read scopes only and the assistant can look but not change anything; add write scopes and it can act on the answer too, within your own permissions.

  • Your permissions, not more. A token can never see more than you can. The assistant reads your sites, with your role’s access.
  • Scoped and expiring. Read or write scopes, chosen per module. Expiry from 7 days to 1 year. Revoked the moment you confirm it.
  • Read-only if you want it to be. On read scopes only, the assistant looks up and summarises and changes nothing. Add write scopes and it can act as well, within the user’s own permissions and sites.
A safety manager in a quiet open-plan office typing a question into an AI assistant on a laptop, a second monitor beside it showing a site map

How It Works

Three Screens That Carry the Feature.

The token you create, the assistant you connect, and the question answered from the record.

The Token, Scoped to What It May Do.

From the user menu, open API Tokens and choose New token. Name it, choose its scopes, read or write, per module: sites, staff, contractors, incidents, inspections, plant, risks, and permits. Then choose when it expires, from 7 days to 1 year. The token is shown once. Revoke it from the same screen and it stops immediately.

  • Read or write scopes, chosen per module
  • Expiry from 7 days to 1 year; up to 10 tokens per user
  • Shown once; revoked the moment you confirm

Creating a token and managing scopes

The Assistant, Connected in One Command.

In Claude Code, one command adds the ComplyFlow server with your token as an environment variable; or drop a small config file into the project. In VS Code, GitHub Copilot picks it up from a config file and asks for the token once. Node.js 20 or later is the only requirement on the machine.

  • Claude Code: one terminal command or one config file
  • GitHub Copilot in VS Code: a config file and Agent mode
  • ChatGPT, and any other assistant that speaks MCP

Connecting Claude Code or GitHub Copilot

The Question, Answered From the Live Record.

A safety manager asks which sites reported incidents this month. The assistant reads the incident register through the token’s scopes and the manager’s own site permissions, and answers with the rows. Ask a follow-up, ask for a summary, ask it to compare two sites. On a read-only token it looks and changes nothing.

  • The live record, not an export
  • Your sites and your role’s access, nothing more
  • Read-only, unless you add write scopes

The MCP Server overview

What It Is Worth

Time Saved, Nobody Else’s Report, No More Access Than You Allow.

No figure here is a promise. The return depends on how many questions your team answers from ComplyFlow each week and how they answer them today, so bring that to the demo and we will work it through with you.

For the person asking the question

  • The answer where you already are

    Ask in the assistant you have open, not in a dashboard you have to build a filter in.

  • The live record, not last week’s export

    What the assistant reads is what ComplyFlow holds right now, on your permissions.

  • A follow-up, not a new report

    Ask for the same figure by site, by month, or against last quarter, in the same conversation.

For the business

  • Changes only if you allow them

    Give a token read scopes only and the assistant looks up and summarises. Add write scopes and it can act as well, never beyond the user’s own permissions.

  • Control that IT can sign off

    Four layers: a token that expires and is revocable, scopes per module, the user’s own permissions and sites, and organisation isolation.

  • Fewer requests to the data person

    The safety manager answers their own question; the analyst is not building a one-off report for it.

  • The same record everything else uses

    The assistant reads the record the gate, the permits, and the approvals run on. There is no second copy to drift.

The return, in your numbers

  • Questions a week

    How often someone asks who is overdue, what happened at a site, or how many are uncleared.

  • How each is answered today

    A dashboard filter, an export to a spreadsheet, an email to the analyst. Against a sentence typed into an assistant.

  • Reports built by hand a month

    The board summary, the site comparison, the incident roll-up. Against asking for them.

  • What it costs, opens the Help Centre in a new tab

    The MCP Server is documented in the Help Centre with no separate charge published. AI usage has been included in Enterprise plans since 24 March 2026; ask us for your plan.

Where the Help Centre documents an item, its name links to the article.

Who It Is For

What the MCP Server Means for Me.

Find your job. The three lines under it are what changes for you.

How It Stacks Up

An AI Assistant on MCP Against the Ways Questions Are Answered Now.

Two ways a manager gets an answer out of the record today, and what each one cannot do.

A dashboard filter and an exportBuild the view, export it, tidy it in a spreadsheetAsking the analystA one-off report, when they get to it ComplyFlowOne record, your standard
The live record, not a copy Built inPartly Read through the Platform API as you ask
Asked in plain English, in the tool you already have open Not therePartly ChatGPT, Claude, or Copilot, through MCP
A follow-up without starting again Not thereNot there Ask by site, by month, or against last quarter in the same conversation
Limited to your own permissions and sites Built inPartly A token can never see more than you can
Changes data only if you allow it Built inBuilt in Read-only tokens unless you add write scopes
Nobody else’s time spent PartlyNot there The manager answers their own question

This compares ways of working, not named vendors. On a read-only token, nothing is changed in ComplyFlow in any column, including ours.

The Other AI Jobs

Everything Else AI Does in ComplyFlow.

The same criteria, the same record, and the same rule: a person decides. Each feature has its own page; the AI page has the whole picture.

AI Document Review

Every licence, ticket, insurance, and certificate checked against your criteria on upload, before the approver sees it.

AI Agents

A review agent built in AI Tools, on your form type and your criteria, that scores a safety plan or answer as it is submitted.

AI Prequalification

A Supplier’s safety system, WHS policy, and SWMS reviewed against set criteria as they submit, then a person decides.

AI SWMS Review

A safe work method statement read against your criteria on the permit, the SWMS form, or the prequalification, before it is approved.

AI Course Creator

A site induction or toolbox talk drafted from your own procedures, edited by you, then published and assigned in Training.

AI in ComplyFlow

Review, draft, and ask: the three AI jobs on one page, with how they fit together.
  • ISO 27001 certified ISO 27001Certified 2019
  • AWS Qualified Software Certified 2023
  • GDPR, General Data Protection Regulation Compliant 2020
  • Microsoft Okta Single sign-on

Security & Data

Certified, Audited & Hosted in Australia.

Your compliance record is the evidence you rely on when somebody asks, so where it lives and who can reach it matters. ComplyFlow is ISO 27001 certified, runs on AWS in Australia, and your people sign in with the accounts they already have.

Questions

Questions People Ask About the MCP Server.

What is MCP?

The Model Context Protocol, an open standard that lets an AI assistant connect to another system safely. ComplyFlow ships an MCP server that works with your data through the Platform API using a scoped token you create, so an assistant can look up and summarise your record, and act on it too if the token allows.

Which assistants can connect?

ChatGPT, Claude, Claude Code, and GitHub Copilot, and any other assistant that speaks MCP. The Help Centre’s set-up guides cover Claude Code, which connects in one command, and GitHub Copilot in VS Code, which takes one config file.

Can the assistant change anything in ComplyFlow?

Only if you let it. Give a token read scopes only and the assistant can look up and summarise incidents, inspections, Suppliers and contractors, Workers, risks, plant, sites, and permits, but not change anything. Add write scopes and it can act on the answer too, always within the user’s own permissions and site assignments.

How is it secured?

Four layers, as the Help Centre lists them: a personal API token that expires within a year and is revoked the moment you confirm it; scopes that limit the token to named modules, read or write as you choose; the permissions and site assignments of the Staff User who created it; and isolation between organisations. A token can never see more than you can.

Who can create a token?

A Staff User with API token management permission, from the user menu under API Tokens. Contractors and Workers do not create tokens. Each user can hold up to 10 active tokens, and each is shown once at creation.

What does it cost?

The Help Centre documents the MCP Server without a separate charge. AI usage has been included in Enterprise plans since 24 March 2026; for other plans, ask us. The MCP Access collection has the set-up guides.

Ask It Something on the Demo.

Book 30 minutes. We will connect Claude Code to a demo account in front of you and you can ask the record whatever you like.

Book a Demo All AI in ComplyFlow
  • ISO 27001
  • Hosted on AWS
  • Microsoft & Okta SSO
  • API & MCP
  • Data in Australia

Compliance you can prove, instantly.