Building an MCP Layer to Streamline AI-Native Audits

Compliance work has always been about context: an auditor asks for evidence, and someone on your team has to figure out what’s being requested, where that data lives, and how to package it correctly.

Thoropass has already helped reduce a lot of that busy work through our investment in integrations and AI-driven automation. But even with these innovations, evidence collection can still take time. You might have AWS, GitHub, Okta, and other systems connected, but someone still has to interpret the request, find the right artifact, and submit it through the UI. Even with automation, there’s a lot of coordination involved, especially when requests require context or judgment. AI agents are well suited for this kind of work, but they must have access to the right information. 

Learn more: How We’re Combining the Best of People and Processes to Build an AI-Native Auditor

Engineering and security teams are increasingly bringing AI agents into their workflows, and those agents need a way to interact with the tools they already use, both within the organization and with third parties. Simply transferring information is no longer enough – there needs to be context, insight and the ability to understand the data before ingesting it. 

The Model Context Protocol (MCP) is quickly becoming the standard for doing this, and that’s why we’re excited to deliver the Thoropass MCP Server. We built this for security engineers, compliance managers, and DevOps teams working through SOC 2 and similar audits – teams are often under tight timelines and juggling multiple systems at once.

‍

How the Thoropass MCP Helps You

We’ve always had the goal of keeping things as simple as possible, and that ethos continues with this launch, by letting your AI agents work with Thoropass the same way you do.

With our MCP server, an agent can read audit context from Thoropass, understand what the evidence request is asking for, and help retrieve and prepare the right documentation from your connected systems. Instead of jumping between tools and manually coordinating everything, you can delegate parts of that workflow to an agent.

For example, you could ask an agent to review open evidence requests, identify the ones tied to access controls, pull supporting data from your identity provider, and get it ready for submission. With human in the loop, you can be reassured that you’ll have the opportunity for a final review, ensuring that you meet all compliance requirements – but the busywork gets lighter.

For teams running repeat audits, the benefit is even clearer. Much of the work each year is re-collecting and re-submitting similar evidence. MCP-enabled workflows can help reuse those patterns and reduce the amount of manual effort required.

‍

Bringing AI into the audit lifecycle

This isn’t about replacing compliance teams or auditors – our auditors are the best in the business, and their insights and expertise are critical to delivering trusted, rigorous audits. It’s about giving them better tools that can further streamline processes and free them up to do the most high-value and strategic tasks.

Thoropass will remain the system of record. MCP simply gives you a way to connect your AI agents to that system so they can help with structured, repeatable work like evidence collection and submission.

We see this as the next step in compliance automation. Integrations helped connect your systems. MCP helps your agents actually use them. We’re excited to bring this to customers and help make audit workflows faster, more connected, and a lot less manual.

‍