Search a directory of SOC 2 audit and compliance firms; read GRC migration guides. Read-only.
Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read from a real MCP initialize → tools/list handshake against the declared endpoint. No tool was ever invoked — tools/list is the read-only introspection call the protocol defines for this. It reflects what the server advertised at that moment; a hosted endpoint is not pinned to any version and can change without notice.
https://grcmigrate.com/mcp5 tools · 4921mssearch_firmsSearch the GRC Migrate directory of SOC 2 audit and compliance-readiness firms (facts compiled from public sources). Filter by framework, ecosystem, partner status, or category. Read-only.Search the GRC Migrate directory of SOC 2 audit and compliance-readiness firms (facts compiled from public sources). Filter by framework, ecosystem, partner status, or category. Read-only.
| Parameter | Type | Description |
|---|---|---|
| framework | string | e.g. "SOC 2", "ISO 27001", "HIPAA" |
| ecosystem | string | compliance platform ecosystem, e.g. "vanta" or "drata" |
| partner_status | string | only "listed" or "partner"; "suppressed" is never valid |
| category | string | e.g. "pen_test", "vciso_advisory" |
get_firmGet one firm's public directory record by slug. Returns null for unknown or non-public (suppressed) firms.Get one firm's public directory record by slug. Returns null for unknown or non-public (suppressed) firms.
| Parameter | Type | Description |
|---|---|---|
| slug* | string | firm slug, e.g. "a-lign" |
get_introduction_pathGet the public directory URL and what an introduction to a firm requires. READ-ONLY: returns instructions only — it does not submit a request or create a lead.Get the public directory URL and what an introduction to a firm requires. READ-ONLY: returns instructions only — it does not submit a request or create a lead.
| Parameter | Type | Description |
|---|---|---|
| firm_slug* | string | — |
list_resourcesList GRC Migrate guides, question pages, and blog posts available to read (title, description, url, type). Read-only.List GRC Migrate guides, question pages, and blog posts available to read (title, description, url, type). Read-only.
No input schema was published for this tool.
get_resourceGet one guide, question page, or blog post by slug — its title, description, and content (blog body markdown, or the FAQ question/answer pairs for guides and question pages).Get one guide, question page, or blog post by slug — its title, description, and content (blog body markdown, or the FAQ question/answer pairs for guides and question pages).
| Parameter | Type | Description |
|---|---|---|
| slug* | string | — |
5 of 5 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Search a directory of SOC 2 audit and compliance firms; read GRC migration guides. Read-only.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.