AI
Connect AI assistants to 21RISK (MCP server)
What the 21RISK MCP server is What the 21RISK MCP server is
21RISK provides an MCP server — a secure connection point that lets AI assistants such as Claude work with your 21RISK data on your behalf. MCP (Model Context Protocol) is an open standard supported by a growing number of AI tools, so the same connection works across assistants.
Once connected, you can ask your AI assistant questions like "which of our sites have open actions from the last audit?" or "summarize the compliance status for our European sites" — and the assistant answers using live data from 21RISK, limited to what you have authorized.
This article is for anyone who wants to connect an AI assistant to 21RISK, and for administrators who want to understand the access model before their organization starts using it.
Important: A connected assistant never gets more access than you have yourself. You additionally choose, per organization, whether it may only read data or also make changes — and you can withdraw that access at any time.
What a connected assistant can do What a connected assistant can do
| Capability | Requires |
|---|---|
| Search which 21RISK functions are available | Any access |
| Read your data (sites, boards, audits, actions, insurance) | Read-only access |
| Make changes (create or update records) on your behalf | Full access |
| Search and read the 21RISK documentation | Any access |
The assistant always works through the same rules that govern the rest of 21RISK: your user permissions apply, and the access level you grant during authorization acts as an extra ceiling on top of them. With read-only access, the assistant cannot change anything — even if you could make that change yourself in the app.
Connecting from Claude Connecting from Claude
In Claude (claude.ai or the desktop app), add 21RISK as a connector:
- Open Settings → Connectors and choose Add custom connector .
- Enter the server URL:
https://21risk.com/api/mcp - Claude opens a 21RISK sign-in page in your browser. Sign in as you normally would.
Other MCP-compatible tools (for example VS Code) work the same way: point them at https://21risk.com/api/mcp and complete the sign-in when the browser opens.
The authorization screen The authorization screen
After signing in, 21RISK shows you exactly what the application is asking for before anything is shared:
- Which organizations the assistant may access — tick only the ones you want to include.
- Access level per organization — choose Read-only (the assistant can look things up but change nothing) or Full access (the assistant may also create and update records on your behalf).
Click Allow to finish, or Deny if something looks wrong. Nothing is shared until you click Allow.
Tip: Start with read-only access. You can raise an application to full access later from your profile settings — you do not need to reconnect.
Reviewing and withdrawing access Reviewing and withdrawing access
You stay in control after authorizing. Every application you have approved is listed under Settings → Profile , in the Authorized Applications section. There you can:
- See every connected application and which organizations it may access.
- Edit an application's access — add or remove organizations, or switch between read-only and full access. Changes take effect immediately.
- Revoke a single application, or use Delete all authorized applications to revoke everything at once.
Revoking an application immediately invalidates every token issued to it. The application loses access on its very next request and would have to go through the full authorization flow again before it could reconnect.
Good to know Good to know
- The connection uses OAuth, the same industry standard used for "Sign in with…" flows. Your 21RISK password is never shared with the AI assistant.
- Access tokens are short-lived and refreshed automatically while the connection is active.
- Everything the assistant does happens under your name and your permissions, so existing audit trails and permission boundaries keep working unchanged.
- Fair-use rate limits apply per organization plan.