# Thoropass

**Canonical:** https://apis.io/providers/thoropass/  
**Website:** https://thoropass.com/  
**APIs profiled:** 1

Thoropass is an auditor-led, AI-powered compliance and audit automation platform that combines software with expert auditor services. Its products span continuous compliance monitoring and alerting, automated evidence collection, a global control library, vulnerability scanning, and CREST-accredited penetration testing, helping companies achieve and maintain SOC 2, ISO 27001, HIPAA, PCI DSS and HITRUST. For developers and integration partners, Thoropass exposes a Partner API secured with OAuth 2.0 (Authorization Code + PKCE, refresh tokens, and RFC 7591 dynamic client registration) and a hosted, OAuth-protected Model Context Protocol (MCP) server for AI-agent access to audits, evidence requests, controls, alerts, devices and vulnerability data. Thoropass (formerly Laika) is backed by Bain Capital Ventures.

## Kin Score — 22.1 / 100 (emerging)

Scored 2026-08-20 under rubric 0.12.0. Trend: flat (+1.1 from 21.0).

| Facet | Score |
|---|---|
| Discoverability | 87.0 |
| Contract Quality | 0.0 |
| Governance | 18.2 |
| Contract Governance | 18.2 |
| Operational Transparency | 0.0 |
| Developer Ergonomics | 17.9 |
| Commercial Clarity | 38.2 |
| Access Clarity | 38.2 |

## Agent readiness — 18.8 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | verified |
| Auth Clarity | yes |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | no |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Self-serve signup — onboarding: self-serve, pricing: unknown, trial: no (confidence: medium).

## APIs (1)

- **Thoropass Partner API** — OAuth 2.0-secured Partner API for programmatic access to Thoropass audits, evidence requests, controls, monitoring alerts, devices, change requests, training records and vulnera...

## MCP servers (1)

- **Thoropass MCP Server**

## Security (3)

- **Thoropass Authentication** — oauth2 · 1 scheme
- **Thoropass Domain Security** — TLSv1.3 · HSTS · DMARC
- **Thoropass Trust Center** — trust center published

## Tags

Company, Fintech, Compliance, Compliance Automation, Audit, Security, Cybersecurity, GRC, SOC 2, MCP

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/thoropass/). Scores are computed from the provider's own public artifacts under a published rubric.