read thedocs.

intelliGRC is a CMMC / GRC compliance platform for MSPs and their clients. Connecting it to StackJack gives your AI assistant a family of 33 igrc_ MCP tools — MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack. With them, your AI can:

• Review evaluations, the assessment objectives inside them, and each objective's change history
• Inspect system boundaries and the reference lookups (statuses, priority levels, confidentiality/integrity/availability levels, and more) that describe them
• Track the action plan — remediation projects, tasks, and subtasks
• Read the evidence attached to your compliance records
• Act (on Pro plans) — create evaluations, boundaries, action-plan projects/tasks/subtasks, update assessment objectives, and attach or upload evidence

How StackJack authenticates to intelliGRC

intelliGRC uses a static API credential — a client id and client secret issued from the intelliGRC console. There is no login pop-up, no OAuth consent, and nothing to refresh: StackJack sends the credential with every request. The credential's access is defined in intelliGRC, so what your AI can see or change is always bounded by what that credential is allowed to do.

Which intelliGRC organization a call targets

intelliGRC calls this its tenant — the organization a request acts on. One StackJack credential can work across every intelliGRC tenant it has access to:

• You can set a default tenant when you connect, so tools that don't specify one use it.
• Every tool also accepts an optional tenant id parameter that targets a specific organization for that one call.
• Your AI can list the tenants a credential can reach with the igrc_list_tenants tool, then use one of those ids as the override.

If you only work with a single intelliGRC organization, set it as the default and you can ignore the per-call parameter entirely.

Before you begin

• In StackJack: you need a role that can manage connectors (tenant Owner, a co-owner, or an Administrator).
• In intelliGRC: you need to be able to obtain API credentials (a client id and client secret) — from the intelliGRC console or through your intelliGRC contact.
• Know your tenant id if you want to set a default organization for your calls.

Step 1 — Get API credentials from intelliGRC

1. In the intelliGRC console (or via your intelliGRC representative), request API credentials for programmatic access.
2. Record the client id and client secret — you'll paste both into StackJack.
3. Note the tenant (organization) id you want StackJack to use by default. If you manage several intelliGRC organizations, you can leave the default blank and pass a tenant id per call instead.

Step 2 — Add the credentials in StackJack

1. In the StackJack portal, open Connectors.
2. Find the intelliGRC card. Click How To Connect for the same steps inline, or Configure to enter the credentials.
3. Enter the Client ID and Client Secret.
4. Optionally enter a Default tenant id — the intelliGRC organization to act on when a tool doesn't specify one.
5. Leave the Instance URL blank to use the production intelliGRC API. Only set it if intelliGRC gave you a separate sandbox host.
6. Click Save.

What happens when you save

• The client id and secret are stored encrypted in Azure Key Vault — never in the StackJack database, and never shown back to you.
• If this is the first time you configure intelliGRC, a Free-tier subscription for the connector is created automatically so its Free tools work right away.
• StackJack immediately live-validates the credentials by making a cheap authenticated read (listing the tenants the credential can reach). Validation never blocks the save: you'll either see a success confirmation or a "saved but validation failed" warning with the reason.
• The connector card shows the current connection and validity status from then on.

Plans and available tools

• Free includes the 25 read tools: list and get evaluations, assessment objectives and their history, boundaries, action-plan projects/tasks/subtasks, evidence, the reference lookups, and the tenant list.
• Pro adds the 8 write tools: create evaluations, boundaries, and action-plan projects/tasks/subtasks; update an assessment objective; and attach or upload evidence.
• Business offers the same tool set as Pro with a higher monthly call quota.

intelliGRC's API credential is a single shared key, not a per-user login, so all AI traffic authenticates as that one credential — there is no per-user attribution. Current pricing and quotas are shown in the portal's Billing page and at checkout.

Tip — resolve reference ids first. Many create/update tools take numeric ids (a status, a priority level, a boundary's confidentiality/integrity/availability level). Your AI can look these up with the igrc_lookup_* tools before it builds a request, so it uses the exact id intelliGRC expects.

A note on the base URL

StackJack targets the production intelliGRC API by default — leave the Instance URL blank and you're pointed at the right place. If intelliGRC provisioned you a sandbox/dev environment, set the Instance URL to that host to route your calls there instead. If a specific tool ever reports "not found" while others work, that usually indicates the environment you're pointed at doesn't expose that path — switch environments or check with intelliGRC.

Rate limits

intelliGRC publishes no numeric API quota. StackJack applies a conservative per-tenant pace and honors any rate-limit backoff, so bursts of tool calls queue briefly instead of failing — a long read may simply take a little longer.

Rotating or replacing the credentials

The client id and secret are the recovery secret. If you rotate or revoke them in intelliGRC, the stored credential becomes invalid. To restore access, open Connectors → intelliGRC → Configure in StackJack, enter the new client id and secret, and Save.

Troubleshooting