Skip to content

Integration · Developer tools

secureframe.com

Connect Claude & ChatGPT to Secureframe

Ask your AI which compliance tests are failing, how a control is doing, or what is in your risk register. It can search tests, controls, policies, risks, tasks, vendors, devices and personnel in Secureframe. It can also update tests and people, attach evidence, add comments, and create and update POA&M items.

Connect Secureframe free

Free plan, no credit card. Takes about a minute.

Try asking

  • “Which tests are failing right now?”

    The AI searches your compliance tests and reads the failing ones with owner, due date and remediation steps.

  • “Which frameworks are we working on?”

    It lists your compliance frameworks, for example SOC 2 or ISO 27001.

  • “Which employee devices have security issues?”

    It searches devices and shows their security status.

What your AI can do

Tests and controls

Search tests and controls, read status, owner and remediation steps, update tests and attach evidence.

Risks and POA&M

Search the risk register, read risk scores and treatment, and create or update POA&M items.

Vendors, people and devices

Look up vendors and third-party risk vendors, search personnel and devices, and update a person's status or audit scope.

  • “Show the high risks in our risk register.”

    It searches the risk register and reads each risk with its score, owner and treatment.

  • “Add a note to the access review test that this quarter's review is done.”

    It finds the test and attaches evidence as an activity completion note.

  • “Create a POA&M item for missing MFA on the build server, owned by Anna, due 30 June.”

    It creates the item with issue, owner, due date and remediation plan.

111 tools for Secureframe

These tools are switched on when you connect. You can switch any of them off, or require your approval before it runs.

  • add_commentChanges dataAdd a comment with `content` to a record by `commentable_type` and `commentable_id`.
  • add_test_evidenceChanges dataAttach evidence to a test by `test_id`, using an `upload_id` or an `activity_completion` note.
  • archive_a_third_party_risk_management_vendorVisible to othersArchive a supplier (vendor id). Has effects visible outside this system. API summary: Archive a Third Party Risk Management Vendor.
  • archive_integration_connectionVisible to othersArchive a integration connection (integration connection id). Has effects visible outside this system. API summary: Archive an Integration Connection.
  • archive_supplierVisible to othersArchive a supplier (vendor id). Has effects visible outside this system. API summary: Archive a Vendor.
  • attach_accountChanges dataLink a account (user account id). API summary: Link a User Account.
  • create_cloud_resource_framework_asset_scopeChanges dataCreate a new framework asset scope for a cloud resource. API summary: Create Framework Asset Scope.
  • create_custom_connection_dataChanges dataCreate a new data for a custom connection. Required: schema slug, vendor slug or resource data. API summary: Publish data.
  • create_device_framework_asset_scopeChanges dataCreate a new framework asset scope for a device. API summary: Create Framework Asset Scope.
  • create_documentChanges dataCreate a new document. Required: byte size, checksum or filename. API summary: Stage a direct-to-storage File Upload and get an id for attaching the file.
  • create_knowledge_base_answerChanges dataCreate a new knowledge base answer. Required: content, knowledge base question id or type. API summary: Create a Knowledge Base Answer.
  • create_knowledge_base_questionChanges dataCreate a new knowledge base question. Required: content. API summary: Create a Knowledge Base Question.
  • create_poam_itemChanges dataCreate a POA&M item with an `issue` and `owner_id`, plus status, risk level, due date and remediation plan.
  • create_repository_framework_asset_scopeChanges dataCreate a new framework asset scope for a repository. API summary: Create Framework Asset Scope.
  • create_ssp_dutyChanges dataCreate a new ssp duty. Required: duty or ssp report id. Search ssp duties first to avoid duplicates. API summary: Create an SSP Duty.
  • create_ssp_duty_roleDeletesCreate a new ssp duty role. Required: ssp duty id, ssp report id or ssp role id. Search ssp duty roles first to avoid duplicates. Destructive action; may require approval. API summary: Create an SSP Duty Role.
  • create_ssp_policyChanges dataCreate a new ssp policy. Required: name or ssp report id. Search ssp policies first to avoid duplicates. API summary: Create an SSP Policy.
  • create_ssp_reportChanges dataCreate a new ssp report. Required: framework id or name. Search ssp reports first to avoid duplicates. API summary: Create an SSP Report.
  • create_ssp_roleDeletesCreate a new ssp role. Required: role or ssp report id. Search ssp roles first to avoid duplicates. Destructive action; may require approval. API summary: Create a SSP Role.
  • create_supplierChanges dataCreate a new supplier. Required: name or ssp report id. Search suppliers first to avoid duplicates. API summary: Create an SSP Vendor.
  • create_testChanges dataCreate a new test. Required: title. Search tests first to avoid duplicates. API summary: Create a Test.
  • create_test_exportChanges dataCreate a new export for a test. API summary: Create a Test Export.
  • create_user_evidenceChanges dataCreate a new evidence for a user. Required: document type. Search evidence first to avoid duplicates. API summary: Create User Evidence.
  • delete_knowledge_base_answerDeletesPermanently delete a knowledge base answer by knowledge base answer id. Destructive action; may require approval.
  • delete_knowledge_base_questionDeletesPermanently delete a knowledge base question by knowledge base question id. Destructive action; may require approval.
  • delete_messageDeletesPermanently delete a message by message id. Destructive action; may require approval. API summary: Delete a Comment.
  • delete_ssp_dutyDeletesPermanently delete a ssp duty by ssp duty id. Destructive action; may require approval. API summary: Delete an SSP Duty.
  • delete_ssp_duty_roleDeletesPermanently delete a ssp duty role by ssp duty role id. Destructive action; may require approval. API summary: Delete an SSP Duty Role.
  • delete_ssp_policyDeletesPermanently delete a ssp policy by ssp policy id. Destructive action; may require approval. API summary: Delete an SSP Policy.
  • delete_ssp_roleDeletesPermanently delete a ssp role by ssp role id. Destructive action; may require approval.
  • delete_supplierDeletesPermanently delete a supplier by supplier id. Destructive action; may require approval. API summary: Delete an SSP Vendor.
  • get_accountGet one account by account id. API summary: Get a User Account.
  • get_cloud_resourceGet one cloud resource by cloud resource id. API summary: Get a Cloud Resource.
  • get_controlGet one control by `control_id`, with its linked tests and policies when `relationships` is true.
  • get_deviceGet one device by device id. API summary: Get a Device.
  • get_evidenceGet one evidence by evidence id. API summary: Get an Evidence.
  • get_frameworkGet one framework by framework id. API summary: Get a Framework.
  • get_framework_requirementGet one framework requirement by framework requirement id. API summary: Get a Framework Requirement.
  • get_integration_connectionGet one integration connection by integration connection id. API summary: Get an Integration Connection.
  • get_knowledge_base_answerGet one knowledge base answer by knowledge base answer id. API summary: Get a Knowledge Base Answer.
  • get_knowledge_base_questionGet one knowledge base question by knowledge base question id. API summary: Get a Knowledge Base Question.
  • get_messageGet one message by message id. API summary: Get a Comment.
  • get_personGet one person by `user_id`, including onboarding status and audit scope.
  • get_policyGet one policy by `policy_id`.
  • get_productGet one product by product id. API summary: Get a POA&M item.
  • get_repositoryGet one repository by repository id. API summary: Get a Repository.
  • get_riskGet one risk by `risk_id`, with its score, owner and treatment.
  • get_ssp_dutyGet one ssp duty by ssp duty id. API summary: Get an SSP Duty.
  • get_ssp_duty_roleGet one ssp duty role by ssp duty role id. API summary: Get an SSP Duty Role.
  • get_ssp_policyGet one ssp policy by ssp policy id. API summary: Get an SSP Policy.
  • get_ssp_reportGet one ssp report by ssp report id. API summary: Get an SSP Report.
  • get_ssp_report_assessment_objectiveGet one ssp report assessment objective by ssp report assessment objective id. API summary: Get an SSP Report Assessment Objective.
  • get_ssp_report_sectionGet one ssp report section by ssp report section id. API summary: Get an SSP Report Section.
  • get_ssp_report_section_blockGet one ssp report section block by ssp report section block id. API summary: Get an SSP Report Section Block.
  • get_ssp_roleGet one ssp role by ssp role id. API summary: Get a SSP Role.
  • get_supplierGet one supplier by supplier id. API summary: Get an SSP Vendor.
  • get_taskGet one task by `task_id`.
  • get_testGet one test by `test_id`, including status, owner, due date and remediation steps.
  • get_test_exportGet one test export by test export id. API summary: Get a Test Export.
  • get_tprm_vendorGet one third-party risk management vendor by `supplier_id` (the vendor ID).
  • get_trust_center_requestGet one trust center request by trust center request id. API summary: Get a Trust Center Request.
  • get_vendorGet one vendor by `supplier_id` (the vendor ID).
  • list_cloud_resource_framework_asset_scopesList framework asset scopes for a cloud resource. Optional filters: relationships.
  • list_device_framework_asset_scopesList framework asset scopes for a device. Optional filters: relationships.
  • list_frameworksList the compliance frameworks you are working on (e.g. SOC 2, ISO 27001).
  • list_repository_framework_asset_scopesList framework asset scopes for a repository. Optional filters: relationships.
  • list_tprm_vendorsList vendors in third-party risk management, searchable with `q`.
  • list_user_security_settingsList user security settings. API summary: Get user security settings.
  • list_vendorsList vendors in your vendor inventory, searchable with `q`.
  • search_accountsSearch accounts by q, relationships or sort. Use this to find existing accounts before creating a new account. Results are paginated. API summary: List User Accounts.
  • search_cloud_resourcesSearch cloud resources by q, relationships or sort. Use this to find existing cloud resources before creating a new cloud resource. Results are paginated. API summary: List Cloud Resources.
  • search_commentsSearch comments by `q`.
  • search_controlsSearch controls by `q`. Use to find a control's ID and its health.
  • search_devicesSearch employee devices by `q`, with their security status.
  • search_evidenceSearch uploaded evidence by `q`.
  • search_framework_requirementsSearch framework requirements by `q`.
  • search_integration_connectionsSearch integration connections by q, relationships or sort. Use this to find existing integration connections before creating a new integration connection. Results are paginated. API summary: List Integration Connections.
  • search_personnelSearch personnel by `q` (name or email).
  • search_poam_itemsSearch POA&M items (plan of action and milestones) by `q`.
  • search_policiesSearch policies by `q`.
  • search_repositoriesSearch repositories by q, relationships or sort. Use this to find existing repositories before creating a new repository. Results are paginated. API summary: List Repositories.
  • search_risksSearch the risk register by `q`.
  • search_ssp_dutiesSearch ssp duties by q or sort. Use this to find existing ssp duties before creating a new ssp duty. Results are paginated. API summary: List SSP Duties.
  • search_ssp_duty_rolesSearch ssp duty roles by q or sort. Use this to find existing ssp duty roles before creating a new ssp duty role. Results are paginated. API summary: List SSP Duty Roles.
  • search_ssp_policiesSearch ssp policies by q or sort. Use this to find existing ssp policies before creating a new ssp policy. Results are paginated. API summary: List SSP Policies.
  • search_ssp_report_assessment_objectivesSearch ssp report assessment objectives by q or sort. Use this to find existing ssp report assessment objectives before creating a new ssp report assessment objective. Results are paginated. API summary: List SSP Report Assessment Objectives.
  • search_ssp_report_section_blocksSearch ssp report section blocks by q or sort. Use this to find existing ssp report section blocks before creating a new ssp report section block. Results are paginated. API summary: List SSP Report Section Blocks.
  • search_ssp_report_sectionsSearch ssp report sections by q or sort. Use this to find existing ssp report sections before creating a new ssp report section. Results are paginated. API summary: List SSP Report Sections.
  • search_ssp_reportsSearch ssp reports by q, relationships or sort. Use this to find existing ssp reports before creating a new ssp report. Results are paginated. API summary: List SSP Reports.
  • search_ssp_rolesSearch ssp roles by q or sort. Use this to find existing ssp roles before creating a new ssp role. Results are paginated. API summary: List SSP Roles.
  • search_suppliersSearch suppliers by q or sort. Use this to find existing suppliers before creating a new supplier. Results are paginated. API summary: List SSP Vendors.
  • search_tasksSearch compliance tasks by `q`.
  • search_testsSearch compliance tests by `q`, with paging and sorting. Use to find failing tests and their IDs.
  • search_trust_center_requestsSearch Trust Center access requests by `q`.
  • update_cloud_resourceChanges dataUpdate an existing cloud resource identified by cloud resource id. API summary: Update a Cloud Resource.
  • update_knowledge_base_answerChanges dataUpdate an existing knowledge base answer identified by knowledge base answer id. API summary: Update a Knowledge Base Answer.
  • update_knowledge_base_questionChanges dataUpdate an existing knowledge base question identified by knowledge base question id. API summary: Update a Knowledge Base Question.
  • update_messageChanges dataUpdate an existing message identified by message id. API summary: Update a Comment.
  • update_personChanges dataUpdate a person by `user_id`: active, employee type, start or end date, or audit scope.
  • update_poam_itemChanges dataUpdate a POA&M item by `product_id` (the item ID): status, risk level, due date, owner or remediation plan.
  • update_product_discardsVisible to othersUpdate an existing discard identified by poam item id. Has effects visible outside this system. API summary: Discard a POA&M item.
  • update_repositoryChanges dataUpdate an existing repository identified by repository id. API summary: Update a Repository.
  • update_ssp_dutyChanges dataUpdate an existing ssp duty identified by ssp duty id. API summary: Update an SSP Duty.
  • update_ssp_policyChanges dataUpdate an existing ssp policy identified by ssp policy id. API summary: Update an SSP Policy.
  • update_ssp_report_assessment_objectiveChanges dataUpdate an existing ssp report assessment objective identified by ssp report assessment objective id. API summary: Update an SSP Report Assessment Objective.
  • update_ssp_report_sectionChanges dataUpdate an existing ssp report section identified by ssp report section id. API summary: Update an SSP Report Section.
  • update_ssp_report_section_blockChanges dataUpdate an existing ssp report section block identified by ssp report section block id. API summary: Update an SSP Report Section Block.
  • update_ssp_roleDeletesUpdate an existing ssp role identified by ssp role id. Destructive action; may require approval. API summary: Update a SSP Role.
  • update_supplierChanges dataUpdate an existing supplier identified by supplier id. API summary: Update an SSP Vendor.
  • update_testChanges dataUpdate a test by `test_id`: owner, enabled, next due date, interval or justifications.
  • update_trust_center_requestChanges dataUpdate an existing trust center request identified by trust center request id. API summary: Update a Trust Center Request.

Set up in three steps

  1. 1

    Pick the app

    Create a free HeyMyApps account and choose Secureframe from the app list.

  2. 2

    Paste your key

    Choose your Secureframe API address (https://api.secureframe.com for US or https://api-uk.secureframe.com for UK) and paste your API key and secret as one value: the key, a space, then the secret. Create the key in the Secureframe console under Your Profile > Company settings > API keys. Only certain roles can do this, and the secret is shown once.

  3. 3

    Add the link to your AI

    You get a personal MCP link. Add it to Claude, ChatGPT or Cursor:

    1. Click your name, then Settings › Connectors › Add custom connector.
    2. Paste your link as the Remote MCP server URL.
    3. Switch it on from the + menu in a chat.

Questions

What can the AI do in Secureframe?

The AI can search and read tests, controls, frameworks, framework requirements, policies, risks, tasks, evidence, comments, POA&M items, vendors, third-party risk vendors, devices, personnel and Trust Center requests. It can update tests and people, attach evidence to tests, add comments, and create and update POA&M items.

Does the AI see my Secureframe credentials?

No. Your Secureframe API key and secret are encrypted at rest and never shown to the AI. After you save them, they are not shown again, not even to you. The AI only sees the results of the tools it calls.

Can I control what the AI is allowed to do?

Yes. You choose which tools are switched on, so you can start read-only. Updating tests, people and POA&M items changes your compliance records, so these can require your approval before they run. Every tool call is logged.

Does it work with ChatGPT?

Yes. In ChatGPT go to Settings › Apps & Connectors › Advanced and turn on Developer mode, then add your HeyMyApps link. Developer mode needs a paid ChatGPT plan: Plus, Pro, Business or Enterprise. The same link also works in Claude (Settings › Connectors › Add custom connector), Cursor and other MCP clients.

What does it cost?

HeyMyApps has a free plan with no credit card required. Paid plans bill per completed task. You also need your own Secureframe account.

Why do I paste the key and secret together?

Secureframe authenticates with an API key plus a secret. HeyMyApps takes them as one value: the key, a space, then the secret. You also pick the API address that matches your Secureframe region, US or UK.

Let your AI work in Secureframe today.

Start free. Your key stays encrypted, and you decide what the AI may do.

Connect Secureframe free

HeyMyApps is not affiliated with Secureframe. Product names are trademarks of their owners.