> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instantcompliance.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect your AI assistant (MCP)

> Give Claude, ChatGPT, Cursor or any MCP-capable AI assistant live, permission-safe access to your compliance data.

Instant Compliance ships a remote [MCP](https://modelcontextprotocol.io) (Model Context Protocol) server. Once connected, your AI assistant can answer questions like *"what's the CDD status of Acme Pty Ltd?"* or *"what compliance actions are outstanding for our firm?"* with live answers from your account — without leaving the assistant.

## How access works

* **You sign in as yourself.** Connecting uses OAuth: your assistant opens an Instant Compliance sign-in page, you approve access for one of your organisations, and the assistant receives its own token. No passwords or API keys are shared with the assistant.
* **Your permissions apply.** Every tool call runs with your own access level, resolved live on every request. If you can't see a customer in the app, neither can your assistant. If you're removed from the organisation, the connection stops working immediately.
* **Everything is audited.** Each tool call is recorded in your organisation's audit trail as you, acting via your AI client (e.g. "Jane used get\_customer\_cdd\_status via Claude").
* **Actions are opt-in.** Reading data and taking action are separate consents. Action tools (starting checks, drafting reports, recording notes) only appear when their scope was granted at connect time — and checks that spend credits say so in their descriptions, so assistants know to confirm with you first.
* **Nothing is ever lodged with AUSTRAC automatically.** Drafting an SMR creates a case for a compliance officer to review, complete and submit.

## Connect from Claude (claude.ai / Claude Desktop)

1. Go to **Settings → Connectors → Add custom connector**.
2. Enter the server URL: `https://YOUR-INSTANT-COMPLIANCE-DOMAIN/api/mcp`
3. Claude opens the Instant Compliance consent screen — sign in, choose the organisation, and click **Allow access**.
4. Ask Claude to run `whoami` to confirm the connection.

## Connect from Claude Code

```bash theme={null}
claude mcp add --transport http instant-compliance https://YOUR-INSTANT-COMPLIANCE-DOMAIN/api/mcp
```

Claude Code will walk you through the browser sign-in the first time you use a tool.

## Connect from Cursor

Add to `.cursor/mcp.json` (Cursor handles the OAuth flow in the browser):

```json theme={null}
{
  "mcpServers": {
    "instant-compliance": {
      "url": "https://YOUR-INSTANT-COMPLIANCE-DOMAIN/api/mcp"
    }
  }
}
```

## Available tools

| Tool                                 | What it returns                                                                                                                              |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `whoami`                             | Who is connected, for which organisation, with which scopes.                                                                                 |
| `find_customer`                      | Search customers by name or email — use it to get the customer id other tools need.                                                          |
| `get_customer_cdd_status`            | The customer's CDD checklist: which steps are done, what's outstanding, whether CDD is required at all.                                      |
| `get_entity_risk_rating`             | Current ML/TF risk level and score, when it was calculated, and any manual override with its reason.                                         |
| `get_ownership_structure`            | The beneficial-ownership tree: owners, effective percentages, verification status, unresolved branches.                                      |
| `get_screening_status`               | PEP / sanctions / adverse-media / terrorism screening status and flags.                                                                      |
| `get_amlctf_obligations`             | Which services are AML/CTF designated services, their category, and your organisation's configured risk tier — with the statutory rationale. |
| `get_outstanding_compliance_actions` | Everything the firm currently needs to act on, sorted by due date — the same feed as the app's home page.                                    |

## Action tools

These only appear when the matching scope was approved on the consent screen, and always require the user to hold the corresponding permission in the platform.

| Tool                   | What it does                                                                                                                                                                           |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `run_kyc_check`        | Starts a KYC identity verification for an individual — emails them a secure verification link. Uses paid check credits; the result arrives asynchronously on the customer's checklist. |
| `run_kyb_check`        | Starts an assisted KYB verification for a company, trust or partnership. Uses paid check credits; results flow back into the entity's checklist.                                       |
| `check_pep_sanctions`  | Runs a PEP/sanctions/adverse-media screen on an existing individual customer. Matches land as UNREVIEWED for an officer to review.                                                     |
| `create_smr_draft`     | Creates a **draft** suspicious matter report case with the statutory AUSTRAC deadline attached and notifies compliance officers. Never submits anything to AUSTRAC.                    |
| `log_compliance_event` | Records a compliance note in the audit trail under a dedicated externally-sourced event type, optionally linked to a customer.                                                         |

## Revoking access

Go to **Settings → AI Assistants** to see every assistant connected to your account and disconnect any of them — access stops on the assistant's very next call. Access tokens also expire on their own after 1 hour (refreshing automatically for up to 30 days of inactivity), and removing a member from the organisation cuts off their assistants immediately.

## Troubleshooting

* **The assistant says it isn't authorised.** Reconnect: the 30-day refresh window may have lapsed, or your membership changed.
* **A tool says a customer isn't visible.** You may lack the `customers.view-all` permission — you only see customers you created, are assigned to, or watch, and so does your assistant.
* **Rate limits.** 120 requests/minute per connection. Sustained loops get HTTP 429 with a `Retry-After` header.