API & MCP

Keel is designed to fit the tools (and the AI agents) you already use. Two integration surfaces make that possible: a REST API with webhooks for automation, and an MCP server for connecting AI assistants directly to your program.

The REST API

The Keel REST API lets you read and manage your program programmatically. Typical uses include:

• List controls and read their status and owner.
• Check ISO 27001 readiness so you can surface posture in your own dashboards.
• Manage tasks: list the work items behind your program, and create new ones.
• Read and write your risk register: list risks and create them.
• Report evidence: list what has been collected, and add a new item as a link or an uploaded file, optionally attached to a control.
• Sync vendors, people and policies: list each, create vendors and policies, and upsert directory people by email. The person and policy writes are idempotent, so a repeated sync updates rather than duplicates.
• Subscribe to webhooks: register a URL to receive signed event notifications when things change in Keel, and wire them into Zapier or your own endpoint.

The full endpoint list, including the machine-readable OpenAPI description at /api/v1/openapi.json, is on the REST API reference.

Authentication

Create an API key in the app (it’s shown once, so store it securely) and send it as a Bearer token against the API. Keys are scoped to your workspace.

Note

For exact endpoints, request and response shapes, and the current event catalog, use the in-app API reference and integrations settings. They’re the authoritative, always-current source. This page describes capabilities as shipped rather than duplicating a schema that can change.

The MCP server

Keel ships a Model Context Protocol (MCP) server so you can connect your own AI agents and MCP-compatible tools directly to your Keel workspace. Instead of copying data back and forth, an agent you trust can work with your program in context (for example, asking about control status, checking ISO 27001 readiness, or helping manage tasks) over the same authenticated API, mediated through MCP. The MCP tool set covers part of the REST surface today; MCP server setup lists the tools in the current release.

This makes Keel a first-class part of an AI-assisted workflow: point a compatible client at the Keel MCP server, authenticate, and your agent can reason over your live compliance program.

Getting started

1. In the app, open Integrations and create an API key.
2. For automation, call the REST API with your key, or subscribe a webhook URL to the events you care about.
3. For AI agents, configure your MCP client against the Keel MCP server and authenticate.

Next steps

• REST API reference: endpoints, authentication, and examples.
• MCP server setup: connect Claude, Cursor, or any MCP client.
• AI tools & credits: Keel’s own built-in AI actions.
• Frameworks & crosswalks: the model your API reads readiness against.