Connect your AI assistant (MCP)

Instant Compliance ships a remote MCP (Model Context Protocol) server. Once connected, your AI assistant can answer questions like “what’s the CDD status of Acme Pty Ltd?” or “what compliance actions are outstanding for our firm?” with live answers from your account — without leaving the assistant.

How access works

You sign in as yourself. Connecting uses OAuth: your assistant opens an Instant Compliance sign-in page, you approve access for one of your organisations, and the assistant receives its own token. No passwords or API keys are shared with the assistant.
Your permissions apply. Every tool call runs with your own access level, resolved live on every request. If you can’t see a customer in the app, neither can your assistant. If you’re removed from the organisation, the connection stops working immediately.
Everything is audited. Each tool call is recorded in your organisation’s audit trail as you, acting via your AI client (e.g. “Jane used get_customer_cdd_status via Claude”).
Actions are opt-in. Reading data and taking action are separate consents. Action tools (starting checks, drafting reports, recording notes) only appear when their scope was granted at connect time — and checks that spend credits say so in their descriptions, so assistants know to confirm with you first.
Nothing is ever lodged with AUSTRAC automatically. Drafting an SMR creates a case for a compliance officer to review, complete and submit.

Connect from Claude (claude.ai / Claude Desktop)

Go to Settings → Connectors → Add custom connector.
Enter the server URL: https://YOUR-INSTANT-COMPLIANCE-DOMAIN/api/mcp
Claude opens the Instant Compliance consent screen — sign in, choose the organisation, and click Allow access.
Ask Claude to run whoami to confirm the connection.

Connect from Claude Code

claude mcp add --transport http instant-compliance https://YOUR-INSTANT-COMPLIANCE-DOMAIN/api/mcp

Claude Code will walk you through the browser sign-in the first time you use a tool.

Connect from Cursor

Add to .cursor/mcp.json (Cursor handles the OAuth flow in the browser):

{
  "mcpServers": {
    "instant-compliance": {
      "url": "https://YOUR-INSTANT-COMPLIANCE-DOMAIN/api/mcp"
    }
  }
}

Available tools

Tool	What it returns
`whoami`	Who is connected, for which organisation, with which scopes.
`find_customer`	Search customers by name or email — use it to get the customer id other tools need.
`get_customer_cdd_status`	The customer’s CDD checklist: which steps are done, what’s outstanding, whether CDD is required at all.
`get_entity_risk_rating`	Current ML/TF risk level and score, when it was calculated, and any manual override with its reason.
`get_ownership_structure`	The beneficial-ownership tree: owners, effective percentages, verification status, unresolved branches.
`get_screening_status`	PEP / sanctions / adverse-media / terrorism screening status and flags.
`get_amlctf_obligations`	Which services are AML/CTF designated services, their category, and your organisation’s configured risk tier — with the statutory rationale.
`get_outstanding_compliance_actions`	Everything the firm currently needs to act on, sorted by due date — the same feed as the app’s home page.

Action tools

These only appear when the matching scope was approved on the consent screen, and always require the user to hold the corresponding permission in the platform.

Tool	What it does
`run_kyc_check`	Starts a KYC identity verification for an individual — emails them a secure verification link. Uses paid check credits; the result arrives asynchronously on the customer’s checklist.
`run_kyb_check`	Starts an assisted KYB verification for a company, trust or partnership. Uses paid check credits; results flow back into the entity’s checklist.
`check_pep_sanctions`	Runs a PEP/sanctions/adverse-media screen on an existing individual customer. Matches land as UNREVIEWED for an officer to review.
`create_smr_draft`	Creates a draft suspicious matter report case with the statutory AUSTRAC deadline attached and notifies compliance officers. Never submits anything to AUSTRAC.
`log_compliance_event`	Records a compliance note in the audit trail under a dedicated externally-sourced event type, optionally linked to a customer.

Revoking access

Go to Settings → AI Assistants to see every assistant connected to your account and disconnect any of them — access stops on the assistant’s very next call. Access tokens also expire on their own after 1 hour (refreshing automatically for up to 30 days of inactivity), and removing a member from the organisation cuts off their assistants immediately.

Troubleshooting

The assistant says it isn’t authorised. Reconnect: the 30-day refresh window may have lapsed, or your membership changed.
A tool says a customer isn’t visible. You may lack the customers.view-all permission — you only see customers you created, are assigned to, or watch, and so does your assistant.
Rate limits. 120 requests/minute per connection. Sustained loops get HTTP 429 with a Retry-After header.

Get started

Core concepts

Webhooks

AI assistants

How access works

Connect from Claude (claude.ai / Claude Desktop)

Connect from Claude Code

Connect from Cursor

Available tools

Action tools

Revoking access

Troubleshooting

​How access works

​Connect from Claude (claude.ai / Claude Desktop)

​Connect from Claude Code

​Connect from Cursor

​Available tools

​Action tools

​Revoking access

​Troubleshooting

How access works

Connect from Claude (claude.ai / Claude Desktop)

Connect from Claude Code

Connect from Cursor

Available tools

Action tools

Revoking access

Troubleshooting