The Core GRC connector lets Claude work in your Core GRC organization: look up vendors and risks, run assessments, edit privacy policies, publish cookie consent settings, handle privacy rights requests, and scan websites for accessibility issues. Claude acts as you, with the permissions you already have in Core GRC.

It works in Claude on the web, Claude Desktop, Claude mobile, Claude Code, and Cursor. The same tools are also available from your terminal with the Core GRC CLI (npm install -g coregrc).

What Claude can do

Tools are grouped by module. Claude only sees a module's tools when your organization has that module active and your role can use them.

Module Prefix What Claude can do
Third-party risk management tprm_ Vendors, assets, services, elements, processing activities, AI systems, risks, issues, documents, assessments, AI incidents, vendor intelligence, and TPRM workflows
Privacy policies and notices policy_ Policies, notices, translations, geolocated variants, published versions, and approval workflows
Cookie consent consent_ Consent websites, cookie scans, cookies, banners, rules, consent records and stats, and publishing to the CDN
Privacy rights rights_ Data subject requests, intake forms, automations, email templates, and request workflows
Website accessibility webaccess_ Accessibility websites, scans, scan issues, and remediation workflows
Platform coregrc_ Who you are signed in as, finding a tool, and reading Core GRC guides

See Tools for the full list.

How it keeps changes safe

  • Your permissions, nothing more. Connecting doesn't create a new role. A user who can only view vendors gets only the read tools for vendors.
  • Claude asks before changing data. Tools that update, publish, archive, or delete are marked so Claude asks you before running them. Tools that only read run without asking.
  • A second check on the big ones. Deleting, archiving, cancelling, restoring a previous version, publishing to the CDN, starting a cookie scan, and anything that uses a paid licence also need an explicit confirm: true. Claude only sends that after you agree.
  • Archive before delete. Where both exist, archiving hides a record and can be undone. Deleting is permanent.
  • Every change is labelled. Records changed through the connector are saved with source mcp, and through the CLI with source cli, so they can be told apart in the app.

Get started

  1. Connect Claude to Core GRC.
  2. Check Permissions to see what controls which tools you get.
  3. Try the Examples.

More: Tools · Documents · CLI

Support

Email support@core-grc.com. Privacy questions: privacy@core-grc.com.