Can my team share one Secureframe connection?

Yes. One person connects Secureframe with an API key and shares the connection with a team in Elaichi, and nobody else ever handles the key. Each teammate still signs in to Elaichi as themselves, so the audit log names the actual person behind every read, comment, or update in Secureframe.

Compliance

Secureframe MCP connector

Connect Secureframe to Claude, ChatGPT, Cursor, or any MCP client through Elaichi, and your team can ask about controls, frameworks, evidence, devices, and cloud resources, then add comments or update scope, all inside each person's own Secureframe access.

Connect on Elaichi How to connect

How it connects. Connects with an API key. The credential goes into a vault nobody reads back.
One address. https://api.elaichi.ai/mcp, the same for every user.
Their own access. An agent never gets more than the person it acts for.

57 tools

How to connect

How to connect Secureframe to Claude, ChatGPT or Cursor

Two steps, about a minute.

In Elaichi

Connect Secureframe once

Open Connections, choose Add connection, and pick Secureframe.
Optionally set Share with to give a team access, then press Connect.
Paste a Secureframe API key. One person generates a token in Secureframe and pastes it once. Everyone else works through Share with, and never sees it.

The credential is vaulted. Nobody reads it back, not even the AI.

Add connection

Choose a connector.

secureframe

All categories

Secureframe

Alloy

Cakewalk

Comp AI

ComplyCube

Drata

In your AI client

Point it at one endpoint

Everyone in the organization uses the same address, and each person only ever reaches what their own account allows.

Secureframe MCP connector for Claude

1

Open Customize, then Connectors.
2

Press Add.
3

Name it, paste the MCP server URL, then Continue.

https://api.elaichi.ai/mcp
4

Sign in and approve.

On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves.

Secureframe MCP connector for ChatGPT

1

Open Plugins, then press the + button.
2

Name it and paste the endpoint into Server URL.

https://api.elaichi.ai/mcp
3

Leave Authentication on OAuth, then tick the risk acknowledgement.
4

Press Create, then sign in and approve.

Works on the web today. The plugin directory lives at chatgpt.com/plugins.

Secureframe MCP connector for Cursor

1

Open ~/.cursor/mcp.json.
2

Add the endpoint under mcpServers.

https://api.elaichi.ai/mcp
3

Reload Cursor, then sign in and approve.

~/.cursor/mcp.json

{
  "mcpServers": {
    "elaichi": {
      "url": "https://api.elaichi.ai/mcp"
    }
  }
}

Set up per machine, so repeat it on each computer you work from.

Connect Secureframe to any MCP client

1

Add the endpoint as a remote MCP server.

https://api.elaichi.ai/mcp
2

Sign in and approve.

{
  "mcpServers": {
    "elaichi": {
      "url": "https://api.elaichi.ai/mcp"
    }
  }
}

The Elaichi Agent already has these tools, with nothing to set up.

Connect Secureframe on Elaichi See pricing

Use cases

What teams do with Secureframe through Elaichi

Every one of these runs inside the access the person already has, and lands in the same audit log.

Compliance

Check control status before the audit call

Ask which SOC 2 or ISO 27001 controls in Secureframe still need attention, pull the details on any one of them, and leave a comment for the owner without opening a tab.
Security

Find cloud resources missing from a framework

List the cloud resources Secureframe knows about, spot the ones not yet in scope for a framework, and add them so the next test run covers everything it should.
IT

Review devices and bring them into scope

See every laptop and workstation Secureframe is tracking, check which ones fall under a given framework, and put a new hire's machine in scope the same afternoon.
Engineering

Keep repositories tagged and in scope

Look up how a code repository is recorded in Secureframe, update its details when a service is renamed, and confirm it counts toward the frameworks your customers ask about.
Risk

Pull evidence details for a customer questionnaire

Ask for the evidence attached to a specific control in Secureframe and get a plain summary you can paste into a vendor security questionnaire answer.
Leadership

Get a readiness summary in plain language

Ask how many controls are passing for each framework in Secureframe and where the gaps are, then record follow-up notes as comments so the team sees them where they already work.

Try asking

“List all Secureframe repositories missing a framework asset scope.”
“Show cloud resources added to Secureframe this week.”
“Summarize open comments on our SOC 2 framework scopes.”

See all 57 Secureframe tools below

Compare

Elaichi vs Zapier MCP vs Composio for Secureframe

All three can connect Secureframe to an AI assistant, and all three have admin controls. They differ in where access lives and how you pay.

Elaichi compared with Zapier MCP and Composio for Secureframe, by what to check
What to check	Elaichi	Zapier MCP	Composio
Where the AI connects	One address for the whole organization. `https://api.elaichi.ai/mcp`	A server per member, created at sign-in.	An MCP endpoint per team, or an SDK.
Control over Secureframe tools	Allow or restrict single Secureframe tools, per role or user.	App and action restrictions on the account.	Role permissions, down to the action.
Record of calls	One audit entry per Secureframe call.	A History tab of tool calls.	A log of every tool call.
Single sign-on	SAML or OIDC, plus SCIM, on Gold.	SAML on Enterprise.	SAML and OIDC on Enterprise.
Price	$15 per user per month.	2 tasks per successful call.	Billed per tool call.

Sources: Zapier MCP docs, security, usage; Composio docs, gateway, enterprise, pricing. Checked September 2026.

Longer take: Zapier MCP alternative and when you don't need an MCP gateway.

AI tools

Secureframe tools for your AI agents

57 tools are ready to call through Elaichi's MCP endpoint the moment you connect Secureframe, governed by the same roles, restrictions, and audit log as everything else in Elaichi.

See it in Elaichi

What connecting Secureframe gets you

6 screens from the product, each doing one job for your Secureframe account.

The agent

Ask about repositories, read live Secureframe answers.

Type a question in plain language and get answers from live Secureframe records.

repositories
cloud resources
framework asset scopes
comments

Ask Elaichi to work across your apps.

List all Secureframe repositories missing a framework asset scope.

Show cloud resources added to Secureframe this week.

Summarize open comments on our SOC 2 framework scopes.

Also runs in Claude, ChatGPT or Cursor

MCP clients

Claude, ChatGPT and Cursor reach Secureframe here.

One governed MCP endpoint over OAuth, no SDK and no shared API key.

ElaichiMCP clients

Claude

ChatGPT

Cursor

Copy the endpoint

https://api.elaichi.ai/mcp

Client	Connected by	Status	Last used
Claude	E Emily Carter	• Connected	4 minutes ago
Cursor	M Megan Brooks	• Connected	2 hours ago
ChatGPT	R Ryan Hayes	• Connected	Yesterday

Tool catalog

57 Secureframe tools arrive ready to call.

Repositories, cloud resources, framework asset scopes and comments, with no custom code written.

List all Secureframe repository framework asset scopes
Create a Secureframe repository framework asset scope
Update a Secureframe repository by ID
List all Secureframe repositories

ElaichiTools

Tool	Action	Description
List all Secureframe repository framework asset scopes	List	List Framework Asset Scopes for a secureframe repository. The absence of a Framework Asset Scope indicates the asset is not in scope for the Framework. Returns: id, active, framework_id, manually_scoped_reason, created_at. Required: repository_id.
Create a Secureframe repository framework asset scope	Create	Create a Framework Asset Scope for a secureframe repository. Framework Asset Scopes are immutable — once created they cannot be modified; create a new scope to update. Returns: id, active, framework_id, manually_scoped_reason, created_at. Required: repository_id.
Update a Secureframe repository by ID	Update	Update a Secureframe repository by id. Returns: id, created_at, updated_at. Required: id.
List all Secureframe repositories	List	List repositories in Secureframe. Returns: id, created_at, updated_at. Supports Lucene syntax filtering via the q parameter and optional relationship sideloading via include and relationships.
Get single Secureframe repository by ID	Get	Get a single Secureframe repository by id. Returns: id, created_at, updated_at. Required: id.

Toolboxes

Every team gets its own Secureframe toolbox.

Curate toolboxes per team so compliance, security and engineering each see their own scope.

Compliance
Security
Engineering
IT Operations

ElaichiToolboxes

Name	Source template	Tools	Created
Compliance toolbox Secureframe · frameworks and asset scopes	Secureframe starter	18	Mar 4, 2026
Security toolbox Secureframe · cloud resources and evidence	—	9	Mar 2, 2026
Engineering toolbox Secureframe · repositories and code scopes	—	24	Feb 27, 2026
IT Operations toolbox Secureframe · asset inventory and owners	Secureframe starter	6	Feb 19, 2026
Internal Audit toolbox Secureframe · comments and review trails	—	31	Jan 30, 2026
Legal toolbox Secureframe · policy and control mapping	—	12	Jan 22, 2026

Shared connections

Teammates query Secureframe without holding credentials.

See who connected each Secureframe account and how many teams and members share it.

Compliance
Security Engineering
Platform
Internal Audit

ElaichiConnections

Connection	Scope	Status	Access
SE Secureframe (Compliance) Connected by Emily Carter	Personal	• Active	1 team · 6 members
SE Secureframe (Security Engineering) Connected by Jake Morgan	Organization	• Active	3 teams · 24 members
SE Secureframe (Platform) Connected by Megan Brooks	Organization	• Active	2 teams · 11 members
SE Secureframe (Internal Audit) Connected by Tyler Reed	Personal	• Needs re-auth	1 team · 3 members
SE Secureframe (IT Operations) Connected by Ryan Hayes	Personal	• Active	Not shared
SE Secureframe (Legal) Connected by Ashley Parker	Personal	• Active	2 teams · 9 members

Audit log

Every Secureframe call is written down.

When, who, what happened, type and resource, appended for each Secureframe request.

When
Who
What happened
Type

ElaichiAudit log

When	Who	What happened	Type
2 minutes ago Mar 6, 2026, 3:10 PM	E Emily Carter emily.carter@northwind.io	Restriction Created	Access
8 minutes ago Mar 6, 2026, 3:04 PM	J Jake Morgan jake.morgan@northwind.io	Restriction Updated	Access
14 minutes ago Mar 6, 2026, 2:58 PM	M Megan Brooks megan.brooks@northwind.io	Role Assigned	Access
20 minutes ago Mar 6, 2026, 2:52 PM	T Tyler Reed tyler.reed@northwind.io	Secureframe Users Updated	MCP
26 minutes ago Mar 6, 2026, 2:46 PM	R Ryan Hayes ryan.hayes@northwind.io	Secureframe Repositories Created	MCP
32 minutes ago Mar 6, 2026, 2:40 PM	A Ashley Parker ashley.parker@northwind.io	Secureframe Repositories List	Toolbox

Launching soon

From answering questions to doing the work

A person no longer has to ask. A trigger starts the work, inside the same permissions and the same audit log as everything else. Automations and live dashboards are launching soon, on the Black plan.

Automations

A schedule drafts your Secureframe evidence digest.

Fetch cloud resources, group them, draft a digest, get approval, comment back in Secureframe.

Secureframe digest

Run 418 · started 2 minutes ago · on behalf of Emily Carter

Run now

✓

Schedule

Every weekday at 8:00 AM

0.2s
✓

Fetch repositories

Secureframe

1.4s
✓

Group by owner

Transform

0.1s
✓

Draft the digest

Agent step

Ran with 4 tools, returned a structured summary

6.2s
Approve the digest

Needs approval

Assigned to Michael Brennan

Approve Deny
Post the digest

Secureframe

Queued

Collections and dashboards

Secureframe compliance numbers refresh on schedule.

Four metrics, 14 days of records created and a team breakdown, computed without a model.

Secureframe health

Refreshed 4 minutes ago · every 15 minutes · from the repositories collection

Live

Repositories

1,284 ↓ 12%

Cloud resources

96 ↓ 8%

Needs attention

3 ↑ 2

Updated this week

412 ↑ 9%

Repositories created

Last 14 days

By team

Share of activity

Compliance 34%

Security Engineering 27%

Platform 21%

Internal Audit 18%

Related connectors

More from the catalog

Browse all 600+ connectors →

FAQ

Frequently asked questions

How do I connect Secureframe to Claude?

In Elaichi, choose Secureframe and paste in an API key from your Secureframe account. Secureframe connects with an API key, so there is no OAuth application to register and no client ID or secret to generate. Then in Claude, open Customize, then Connectors, then Add, and paste the endpoint https://api.elaichi.ai/mcp. Sign in with your Elaichi account and Secureframe is ready.

Does Secureframe work with ChatGPT and Cursor as well as Claude?

Yes. Once Secureframe is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect Secureframe once and every client picks it up.

What can an AI agent actually do with my Secureframe data?

An agent can look up frameworks, controls, and the evidence behind them in Secureframe, list the devices, cloud resources, and code repositories being monitored, and tell you which ones are in scope for a framework. It can also add or edit comments, update a repository or cloud resource, put an asset into scope, and record custom connection data. Because Secureframe exposes a lot of actions, short concrete asks such as 'list failing controls for SOC 2' work better than long paragraphs.

Does connecting Secureframe give the AI access to everything in my compliance workspace?

No. Every request runs as the person who signed in, so an agent only sees the frameworks, controls, evidence, and assets that person can already see in Secureframe. Elaichi can narrow that further with restrictions per team or per action, and it can never grant more than the person's own Secureframe permissions allow.

Can I stop an agent from deleting or changing things in Secureframe?

Yes. Restrictions in Elaichi work per action, so you can allow reading controls and evidence in Secureframe while blocking comment deletion, scope changes, or updates to cloud resources and repositories. A blocked action is never shown to the AI client at all, so no prompt, however worded, can reach it.

What happens to a Secureframe connection when someone leaves?

Offboarding a person in Elaichi ends their access to Secureframe through every client at once, with nothing to revoke in Claude, ChatGPT, or Cursor separately. A Secureframe connection they shared keeps working for everyone else on the team. If you want to remove Secureframe entirely, disconnecting it once in Elaichi removes it from every client.

Does the Secureframe MCP connector work with Gemini, Codex, Claude Code or other MCP clients?

Yes. Secureframe is reached over the same MCP endpoint every client uses, so anything that speaks MCP can call it — Gemini, Codex, Claude Code, Windsurf, Cline, Zed and OpenCode among them — alongside Claude, ChatGPT, Cursor, and the Elaichi Agent. The tools on offer and the access behind them are identical whichever client asks. Only the setup screen differs.

Is Elaichi an alternative to Zapier MCP for Secureframe?

Yes. Both let Claude, ChatGPT or Cursor use Secureframe. Zapier MCP fits a team that already automates in Zapier, since each person signs in and acts as themselves in that account. Elaichi fits when IT wants one address for the whole company, per-tool rules by role, and a record of every Secureframe call.

How is Elaichi different from Composio for Secureframe?

Composio gives AI agents tools and sign-in handling across 1,000+ apps, for developers building agents or people using an assistant, billed per tool call. Elaichi gives a company's own people governed access to Secureframe: one address, restrictions per role or user, and $15 per user per month. Both have role permissions and a log of every call.

Put Secureframe in front of your team

14 days on Gold, no credit card. Connect it once and pick what each team can call.

Connect Secureframe Talk to us

Works with: and any other MCP client, or the Elaichi Agent.
When the trial ends: Nothing is deleted. Connections, roles and the audit log stay where they are, so subscribing picks up exactly where you left off.