4 open gaps · grouped by framework
Encryption at rest SOC 2 · ISO 27001
Access review overdue · Finance HIGH
MFA enforced · all users MET
Change management 1 FIX
Vallorix speaks MCP. Connect it to Claude Code — or any MCP client — and run your compliance program from the terminal: see open gaps, check framework readiness, get grounded remediation, and fix failing controls as code. Every call runs against your own Vallorix instance, so evidence never leaves your boundary.
Ask in plain language, or run the commands. Each one reads (and, with your confirmation, writes) your real compliance data through the Vallorix MCP server.
Every open gap — unimplemented measures and open findings — ranked by what's fixable from this repo, grouped by framework.
“How ready are we for SOC 2 / ISO 27001 / HIPAA / CMMC?” — a real readiness %, the blocking findings, and the shortest path to green.
A fix grounded in the real control requirement and the evidence it needs — minimal, security-safe, never a generic guess.
Scans your repo, generates the minimal change, and opens a PR attributed to the control it satisfies — then updates the measure in Vallorix.
Flags evidence that's expiring, still manual, or missing — so nothing lapses the week before your audit.
The copilot talks only to your Vallorix instance — self-hosted or hosted. Your controls and evidence never go to a vendor's cloud.
The plugin is open source. Point it at your instance with a scoped Personal API Key — its permissions follow your Vallorix role.
Every other GRC copilot runs against the vendor's hosted platform. Vallorix is self-hostable, so the MCP endpoint points at your own instance — remediation is computed from your controls and evidence, and none of it leaves your infrastructure.
Open source, MCP-native, and sovereign — your compliance copilot, running against infrastructure you control.