API & MCP

Keel is designed to fit the tools — and the AI agents — you already use. Two integration surfaces make that possible: a REST API with webhooks for automation, and an MCP server for connecting AI assistants directly to your program.

The REST API

The Keel REST API lets you read and manage your program programmatically. Typical uses include:

• List controls and read their status and coverage.
• Check readiness for a framework so you can surface posture in your own dashboards.
• Manage tasks — create and update the work items behind your program.
• Subscribe to webhooks — register a URL to receive signed event notifications when things change in Keel, and wire them into Zapier or your own endpoint.

Authentication

Create an API key in the app (it’s shown once — store it securely) and send it as a Bearer token against the API. Keys are scoped to your workspace.

Note

For exact endpoints, request and response shapes, and the current event catalog, use the in-app API reference and integrations settings — they’re the authoritative, always-current source. This page describes capabilities as shipped rather than duplicating a schema that can change.

The MCP server

Keel ships a Model Context Protocol (MCP) server so you can connect your own AI agents and MCP-compatible tools directly to your Keel workspace. Instead of copying data back and forth, an agent you trust can work with your program in context — for example, asking about control status, checking framework readiness, or helping manage tasks — using the same capabilities the API exposes, mediated through MCP.

This makes Keel a first-class part of an AI-assisted workflow: point a compatible client at the Keel MCP server, authenticate, and your agent can reason over your live compliance program.

Getting started

1. In the app, open Integrations and create an API key.
2. For automation, call the REST API with your key, or subscribe a webhook URL to the events you care about.
3. For AI agents, configure your MCP client against the Keel MCP server and authenticate.

Next steps

• AI tools & credits — Keel’s own built-in AI actions.
• Frameworks & crosswalks — the model your API reads readiness against.