compliance-tools

   ___                      _ _                        _____           _
  / __|___ _ __  _ __  _ __| (_)__ _ _ _  __ ___      |_   _|__  ___  | |___
 | (__/ _ | '  \| '_ \| / _` | / _` | ' \/ _/ -_)      | |/ _ \/ _ \ | (_-<
  \___\__/|_|_|_| .__/|_\__,_|_\__,_|_||_\__\___|      |_|\___/\___/ |_/__/
                |_|

Compliance Tools

Claude Code plugins for audit prep. SOC2 today, more frameworks later.

What's Inside

Plugin	Slash Command	What It Does
soc2-startup	/soc2	Lean SOC2 Type 1 guidance — 7 roles, workflows, CC1-CC9 reference
probo	/probo	Probo platform integration via MCP — risks, policies, controls, vendors

soc2-startup Roles

Role	Use When You Need To...
Lean Guardian	Stop over-engineering compliance
Policy Writer	Write auditor-ready policies without fluff
Gap Analyzer	Find what's actually missing
Evidence Collector	Gather what auditors request (nothing more)
Control Mapper	Map controls to CC1-CC9
Risk Assessor	5x5 risk matrix, real risks only
Readiness Reviewer	Simulate auditor scrutiny before the real thing

Setup

# Add the marketplace
claude plugin marketplace add fsch/compliance-tools

# Install what you need
claude plugin install soc2-startup@compliance-tools
claude plugin install probo@compliance-tools

Probo Setup (optional)

The probo plugin needs a running Probo MCP server:

# Add your API token
echo 'PROBO_API_TOKEN=your-token-here' >> .env

# Configure the MCP server in .mcp.json (see Probo docs)

Usage

/soc2 readiness-check      — How ready are we?
/soc2 gap-analysis          — What's missing?
/soc2 write-policy [type]   — Write a lean policy
/soc2 collect-evidence [cc] — Gather evidence for CC criteria
/soc2 lean-check            — Are we over-engineering?

Or just ask naturally:

"Review our access control policy for SOC2 compliance"
"What evidence do we need for CC6?"
"Write a vendor management policy for our startup"

Philosophy

Minimum viable compliance. Startups don't need enterprise playbooks. This plugin knows the difference between what auditors actually check and what consultants try to sell you.

• Policies under 20 pages
• Evidence you can collect in 2 hours/week
• Controls a 20-person team can sustain
• Two-tier scoping: CC1-CC5 org-wide, CC6-CC9 production only

License

MIT