@ismsdirectory/mcp-server

Model Context Protocol (MCP) server for the ISMS Directory catalog.

Zero-install alternative (preferred for web agents):
GET https://ismsdirectory.com/api/search (see llms.txt).

This package is for IDE / desktop agents that speak stdio MCP. It fetches the public catalog snapshot from https://ismsdirectory.com/api/tools.json at startup (requires network).

Installation

Claude Desktop

{
  "mcpServers": {
    "isms-directory": {
      "command": "npx",
      "args": ["-y", "@ismsdirectory/mcp-server"]
    }
  }
}

Claude Code

claude mcp add isms-directory -- npx -y @ismsdirectory/mcp-server

Other MCP clients

npx -y @ismsdirectory/mcp-server

CLI (catalog search, no MCP)

npx -y @ismsdirectory/mcp-server search --framework iso-27001 --region germany
npx -y @ismsdirectory/mcp-server search --q "iso 27001 consultants"

The ismsdirectory binary talks to GET /api/v1/search. No API key.

Tools

search_services

Exact multi-filter catalog search. Multiple frameworks values are ANDed.

query: "Mittelstand" (optional free-text ranking within filters)
framework: "ISO 27001" (optional legacy single)
frameworks: ["ISO 27001", "DORA"] (optional, AND)
region: "Germany" (optional, service coverage tags)
industry: "Healthcare" (optional)
service_type: "Consulting" (optional; also matches "Consultants")
limit: 10 (optional, 1-25)

At least one parameter is required. Tag filters use case-insensitive exact match (not substring).

Example: ISO 27001 and DORA and Germany and Consulting:

frameworks: ["ISO 27001", "DORA"]
region: "Germany"
service_type: "Consulting"

check_if_listed

company_name: "Scrut Automation" (required)

get_service_details

service_name: "Compleye" (required)

list_categories

dimension: "frameworks" | "regions" | "industries" | "service_types" | "problems"

submit_listing (write)

Free-tier queue only (not live instantly). Confirm name, website, contact email, and one-line summary with the user before calling.

name: "Acme Compliance" (required)
url: "https://acme.example" (required, http/https)
email: "[email protected]" (required, not shown publicly)
brief_summary: "ISO 27001 consulting for SaaS" (required, 10-300 chars)
description, linkedin, service_type[], region_covered[],
compliance_framework_expertise[], ... (optional)

POSTs to https://ismsdirectory.com/api/submit. Same queue as the free web form (~months). Soft-nudge Fast-track: https://ismsdirectory.com/submit

Prefer catalog search first

For vendor discovery, use search_services / HTTP /api/search. Use submit_listing only when authorized to add a listing.

Security

Read-oriented catalog tools over a public JSON snapshot:

• No credentials required for search
• No filesystem access
• Stdio transport only (no open HTTP port on the package)
• Inputs validated with Zod length limits

Not offline: startup requires fetching the public catalog URL.

SBOM

Each published version ships a CycloneDX JSON software bill of materials inside the npm tarball: node_modules/@ismsdirectory/mcp-server/sbom.cdx.json (also visible via npm pack). It lists the package and its runtime dependency tree (names, versions, licenses) generated from the lockfile at publish time.

Source

MIT. Repo: mcp-server