Connecting AI Assistants to Concord (MCP)

Connect Claude, ChatGPT, Codex, Cursor, and other MCP clients to your Concord account with one server URL, then manage write access and connected applications.

Overview

Concord's MCP server connects the AI assistants your team already uses to your Concord account. Once an assistant is connected, you can ask Claude, ChatGPT, Codex, Cursor, VS Code, or any other MCP client about your privacy and compliance program in plain language, and it answers from your live Concord data.

One URL, no API keys. Every assistant connects to https://api.concord.tech/mcp. You sign in with your normal Concord login, approve the connection, and choose an organization.
Read access on every plan. Assistants can read consent and tracker data, privacy requests, your data map, policies and documents, and tasks, plus risks, vendors, controls, and frameworks when your organization uses them.
Write access is opt-in. On plans that include API access, an Owner or Admin can let assistants create and update records. Writing stays off until they turn it on.
Your permissions apply. Every request is checked against your current Concord role, so a connection can never do more than you can do in the app. If your role changes, your connections change with it.

If you don't see AI Assistants (MCP) under Integrations → AI & API Access, contact support@concord.tech to turn it on for your organization.

Before You Start

Who can connect: any Concord user. An assistant can only see and do what your role allows. See User Roles and Permissions.
Read tools: included on every plan.
Write tools: available on Concord Privacy Pro, Premium, and Enterprise, and on Concord Trust Pro, Premium, and Enterprise. An Owner or Admin also has to turn them on. See Turn On Write Tools.
Module tools: tools for risks, vendors, controls, and frameworks appear only when those modules are on for your organization.

Find the Setup Steps in Concord

Go to Integrations → AI & API Access → AI Assistants (MCP). The Connect an Assistant card shows the server URL with a copy button, and setup steps for each assistant under the Claude, ChatGPT, Cursor, and Other tabs.

The steps for each assistant are below as well.

Connect Your Assistant

Claude and Claude Desktop

In Claude, open Settings → Connectors and choose Add custom connector.
Paste the server URL, https://api.concord.tech/mcp. Leave the advanced fields (client ID and secret) empty.
Sign in to Concord when the browser prompt appears, then approve the connection. See Sign In and Approve.

Anthropic's guide to custom connectors has more detail.

Claude Code

Run this command in your terminal:

claude mcp add --transport http --scope user concord https://api.concord.tech/mcp

Then run claude mcp login concord in your terminal and approve the browser sign-in. --scope user makes Concord available in every project, not only the folder you ran the command in.

ChatGPT

Turn on developer mode in ChatGPT.
Add a connector with the server URL, https://api.concord.tech/mcp.
Sign in to Concord when prompted, then approve the connection.

Connectors are available on paid ChatGPT plans on the web. OpenAI's developer mode guide has the steps.

Codex

Run this command in your terminal:

codex mcp add concord --url https://api.concord.tech/mcp

Then run codex mcp login concord and approve the browser sign-in.

Cursor

Click Add to Cursor on the Cursor tab in Concord, or add the server to ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "concord": {
      "url": "https://api.concord.tech/mcp"
    }
  }
}

Cursor asks you to sign in the first time you use it.

VS Code and Other Clients

Any MCP client that supports remote servers over HTTP, such as VS Code, Windsurf, or Gemini CLI, can connect with the server URL. Add it in the client's MCP settings, then approve the sign-in.

In VS Code, add the server to .vscode/mcp.json, or use MCP: Add Server from the command palette:

{
  "servers": {
    "concord": {
      "type": "http",
      "url": "https://api.concord.tech/mcp"
    }
  }
}

The first time an assistant connects, it opens your browser:

Sign in on the Concord login page the way you normally do. If you're already signed in, you go straight to the consent screen.
Review the consent screen. It names the assistant asking for access and what it's asking for: Read your privacy and trust data, and, if the assistant requests it, Create and update records on your behalf. Write access is optional and stays off unless you turn it on.
Choose the organization for this connection. Each connection works with one organization. To use another, connect again and choose it.
Approve. The browser hands control back to your assistant, and you can start asking questions.

Turn On Write Tools

Write tools let an assistant make changes in Concord, such as logging a privacy request or adding a data system. They're off by default. To turn them on, you need the Owner or Admin role and a plan that includes API access.

Go to Integrations → AI & API Access → AI Assistants (MCP).
In the Write Tools card, turn on Allow Write Tools. This makes every write tool available to connected assistants.
To limit what assistants can change, open Customize Which Tools and turn off the tools you don't want them to use.

If your plan doesn't include write tools, the card shows a note instead and the switch stays off.

Tool	What It Does
Create Task	Create a task and optionally assign it.
Assign Task	Assign a task to a user.
Transition Task	Move a task to a new status.
Create Privacy Request	Log a new privacy request (DSAR) on behalf of a data subject.
Update Privacy Request	Add notes, set a resolution status, or acknowledge a request.
Add Data System	Add a data system to your data map.
Update Data System	Update the fields on an existing data system.
Classify Trackers	Add discovered trackers to a project with a consent category.
Run Tracker Scan	Start a cookie and tracker scan. A scan uses Actions, as it does when you run one in the app.
Create Risk	Add a risk to your risk register. Requires the Risks module.
Create Vendor	Add a vendor from the catalog or as a custom record. Requires the Vendors module.
Update Vendor	Update a vendor and its linked data systems. Requires the Vendors module.
Open Vendor Review	Open a review for a vendor. Requires the Vendors module.
Add Control Evidence	Link a document or URL as evidence for a control. Requires the Controls module.

Write tools add and update records. They don't delete anything, and an assistant can't resolve a privacy request: a person on your team still does that in Concord. For how a scan uses Actions, see Actions and Data Credits.

Approving Write Access on a Connection

Turning on write tools for your organization doesn't give existing connections write access. Each connection needs its own approval:

If your assistant asks for write access when you connect, turn on Create and update records on your behalf on the consent screen.
If you approved a connection as read-only and your assistant later tries a write tool, Concord asks it for write access, and your assistant shows a sign-in prompt where you can approve it.

Example Prompts

Consent and trackers:

"List the trackers our latest scan found that aren't in a project yet."
"Summarize this month's consent opt-in and opt-out rates by region."

Privacy requests:

"How many privacy requests are open right now, and which ones are past due?"

Data map and policies:

"List our data systems and the processing activities they support."
"Summarize our privacy policy and show its version history."

Controls and evidence, if your organization uses them:

"Which controls are due for evaluation in the next 30 days?"
"What evidence expires in the next 30 days?"

With write tools turned on:

"Add our new Snowflake instance to the data map."
"Create a task to review our cookie policy and assign it to me."

Revoke a Connection

You can see and revoke the assistants connected to your account under Connected Applications, in two places:

My Profile, which you open from the account icon in the upper right of Concord.
Integrations → AI & API Access → AI Assistants (MCP), below the setup steps.

Click Revoke Access next to an assistant and confirm. That assistant loses access to your Concord data on its next request, and it has to sign in and approve again to reconnect.

Removing Concord from an assistant's own settings stops that assistant from using the connection, but it doesn't revoke it. Use Connected Applications to revoke.

Because every request is checked against current permissions, removing a person from your organization or changing their role applies to their connections too.

Troubleshooting

The Browser Doesn't Open

Start the sign-in again from your assistant (run claude mcp login concord for Claude Code, or reconnect in the client's MCP settings) and check that a pop-up blocker didn't stop the window. Most command-line clients also print the sign-in link so you can copy it into your browser.

Your organization may not have AI Assistants (MCP) turned on yet. Contact support@concord.tech to turn it on.

Tools Are Listed but a Request Is Refused

Either the connection was approved as read-only, or your Concord role doesn't allow that action. The refusal message says which. For write access, approve it when your assistant asks. For a role change, ask an Owner or Admin.

New Tools Don't Appear

Your assistant keeps the list of tools it received when it connected. If an Owner or Admin turned on write tools, or your organization turned on a module such as Controls after you connected, reconnect in the assistant's MCP settings to load the new list. Reconnecting doesn't add write access on its own; see Approving Write Access on a Connection.

Answers Come From the Wrong Organization

Each connection is tied to the organization you chose when you approved it. Connect again and choose the right one.

The Connection Stopped Working

Connections expire after a period of time. Reconnect in your assistant's MCP settings. If you're already signed in to Concord in your browser, it only takes a few seconds.

Adding and Managing API Keys, for calling the Concord REST API directly.
User Roles and Permissions
Actions and Data Credits

Connecting AI Assistants to Concord (MCP)

On this page