VComply has written a sensible case for MCP in compliance software. In MCP Servers, AI Agents, and the Next Era of Compliance, the governance, risk and compliance vendor describes the work agents could remove: a security team completes an access review, compliance asks for the evidence, someone finds it, uploads it, and a compliance officer updates the status. “People effectively become the connection between systems.” An agent with controlled access could answer “Which obligations are overdue this month?”, “Who owns this control?” and “Where is the latest evidence?”
There are no figures, and the post is careful where it counts. The distinction it draws is between reading and acting: “Which controls are overdue?” retrieves information; “Mark these controls complete” changes the compliance record. “Someone who can read a policy should not automatically be able to edit it through AI.” The prescription is the right one: “start with read, then move carefully toward action,” low-risk actions such as comments and follow-up tasks next, and complex workflow execution only once accuracy and permissions are understood. “The goal should not be maximum autonomy. It should be the right amount of autonomy for the risk involved.” It names its own product near the end: the VComply MCP Server lets authorized clients such as Claude work with obligations, tasks, ownership, evidence and permitted workflow actions.
The catalog has nothing to set against it. The VComply provider page lists no API pages, and every one of the nineteen Agent Readiness dimensions is unlit, including the MCP server the post describes. No machine-readable description of VComply’s API or MCP server has been found.
The Kin Score is 22.0, emerging band, carried by access clarity at 60.5 and discoverability at 55.4 against contract quality and contract governance at 0.0. The Agent Readiness score is 0.0, human-only. The post’s own rule applies to its catalog record first. Start with read: before an agent can be trusted to mark a control complete, something has to tell it which tools exist, what each one changes, and which require approval. That is what a published tool list, an OpenAPI description or an agent card does. VComply has argued well for careful, read-first autonomy in compliance. The first thing an agent would read about VComply itself has not been published.