Connect Diligent to ChatGPT: Automate Risk and Compliance Governance

If you need to connect Diligent to ChatGPT so your AI agents can read audit evidence, track strategic risks, update control performance schedules, or orchestrate compliance robots, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's JSON-RPC tool calls and Diligent's highly structured REST APIs.

If your team uses Claude, check out our guide on connecting Diligent to Claude or explore our broader architectural overview on connecting Diligent to AI Agents.

Giving a Large Language Model (LLM) read and write access to an enterprise Governance, Risk, and Compliance (GRC) platform is an immense engineering challenge. You either spend weeks building, hosting, and maintaining a custom MCP server to translate LLM JSON arguments into Diligent's strict payload requirements, or you use a managed infrastructure layer to dynamically generate a secure, authenticated MCP server URL.

This guide breaks down exactly how to use Truto to generate an MCP server for Diligent, connect it natively to ChatGPT, and execute complex GRC workflows using natural language.

The Engineering Reality of the Diligent API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, implementing it against Diligent's API surface introduces significant friction.

If you decide to build a custom MCP server for Diligent, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with the Diligent One Platform and HighBond APIs:

Segmented Application Ecosystem

Diligent is not a single flat database. It is a suite of distinct modules (Strategy, Projects, Results, Robots, Evidence Hub). The API surfaces reflect this division. If a user asks ChatGPT to "show me all risks affecting our EU operations," the MCP server needs to know whether they mean a Strategy Risk (which exists at the enterprise level) or an Objective Risk (which exists inside a specific project). Exposing the entire API surface raw to an LLM often causes hallucinations because the model confuses list_all_diligent_org_strategy_risks with list_all_diligent_objective_risks. You must strictly curate the tools available to the context window.

Immutability and Audit Locks

Standard API assumptions assume that a DELETE request removes a record. In Diligent, compliance constraints override API requests. If a user asks an AI agent to delete an objective, but that objective is part of a checked-out Offline Project or belongs to an active certification program, the API will reject the request. Your MCP layer must pass these specific business-logic rejections back to the LLM so it can inform the user, rather than swallowing the error or crashing.

Complex Relational Mapping

Records in Diligent are heavily normalized. Linking a Strategy Risk to an actual operational control in a Project requires creating a strategy_assurance record. Linking an Entity (like a business unit) to a Project requires a project_entity link. If ChatGPT needs to update a risk's score based on a new finding, it has to traverse the hierarchy from Project -> Objective -> Risk -> Control. Writing manual JSON-RPC handlers for these deeply nested relationship chains is a maintenance nightmare.

Strict Rate Limits and 429 Handling

Diligent enforces strict rate limiting on API calls. When those limits are hit, Diligent returns an HTTP 429 status code. Factual note on how Truto handles this: Truto does not retry, throttle, or apply automatic backoff on rate limit errors. Instead, Truto normalizes the upstream Diligent rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec, and passes the 429 error directly back to the caller (ChatGPT). The LLM or the calling agent framework is fully responsible for orchestrating retry and backoff logic.

Step 1: Generate a Diligent MCP Server

Instead of building a bespoke server to handle these quirks, we will use Truto to dynamically generate a Diligent MCP endpoint. This endpoint maps Diligent's documentation and resource schemas into AI-ready JSON-RPC tools dynamically.

You can create this server in two ways: via the Truto UI or programmatically via the API.

Method A: Via the Truto UI

1. Log into your Truto account and navigate to Integrated Accounts.
2. Click on your active Diligent connection to open the account details page.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. In the configuration modal, give the server a name (e.g., "Diligent GRC ChatGPT").
6. Select the allowed methods (e.g., read, write) and any specific tool tags you want to expose (e.g., compliance, risks).
7. Click Create and copy the generated MCP server URL.

Method B: Via the API

For teams embedding AI into their own software, you can provision an MCP server for a specific user's Diligent account via a single POST request.

You need the integrated_account_id for the Diligent connection.

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Diligent Strategy and Risks",
    "config": {
      "methods": ["read", "write"],
      "tags": ["strategy", "projects", "evidence"]
    }
  }'

The API provisions the secure infrastructure at the edge and returns a payload containing the new server URL:

{
  "id": "mcp_abc123",
  "name": "Diligent Strategy and Risks",
  "url": "https://api.truto.one/mcp/t_7f8a9b0c1d2e3f4g5h6..."
}

This single URL (url) handles routing, authentication, and dynamic tool generation.

Step 2: Connect the MCP Server to ChatGPT

With the server URL copied, you can connect it to ChatGPT. This can be done directly in the ChatGPT interface or via a local configuration file for programmatic usage.

Method A: Via the ChatGPT UI

Note: MCP support in the ChatGPT UI requires Developer mode, which is available on Pro, Plus, Business, Enterprise, and Education accounts.

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Enable the Developer mode toggle.
3. Under the MCP servers (or Custom connectors) section, click Add new server.
4. Enter a name (e.g., "Diligent Truto").
5. Paste the Truto MCP server URL into the Server URL field.
6. Click Save.

ChatGPT will immediately ping the server's initialize endpoint, perform the handshake, and fetch the list of available Diligent tools.

Method B: Via Manual Config File (SSE Client)

If you are running a local instance of an MCP client or building an agentic workflow that connects to ChatGPT's APIs, you can route the connection using the official MCP Server-Sent Events (SSE) bridge.

Create an mcp_config.json file:

{
  "mcpServers": {
    "diligent_grc": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/t_7f8a9b0c1d2e3f4g5h6..."
      ]
    }
  }
}

When your agent runtime boots, it will execute the server-sse command, connecting the local process securely to the Truto edge endpoint.

Hero Tools for Diligent

Diligent has a massive API surface. By curating the tools you expose to the LLM (using the tags and methods filters during server creation), you prevent hallucination and keep the agent focused. Here are six high-leverage hero tools for automating GRC workflows.

List All Strategy Risks

Tool: list_all_diligent_org_strategy_risks

Fetches the high-level strategic risks defined in the organization's Strategy module. This is critical for executive reporting and macro-level risk tracking.

"Get a list of all strategic risks for our organization. Specifically, look for any risks currently marked with a status of 'audit'."

Update a Strategy Risk

Tool: update_a_diligent_org_strategy_risk_by_id

Allows the agent to modify a strategic risk's title, description, status, or custom attributes. Essential for automated workflows that adjust risk profiles based on new evidence or completed audits.

"Update the strategy risk with ID '90210'. Change its status to 'mitigated' and add a note to the description that the Q3 security audit was completed successfully."

List Compliance Regulations

Tool: list_all_diligent_org_compliance_regulations

Retrieves all compliance regulations (e.g., SOC 2, ISO 27001, GDPR) configured in the One Platform organization.

"Pull the list of all compliance regulations we are currently tracking in Diligent. I need to verify if NIS2 has been added to our active frameworks."

Create an Evidence Record

Tool: create_a_diligent_org_evidence

Creates a new evidence record in the Diligent Evidence Hub. This is the foundation for automating proof collection—an agent can detect an event, gather logs, and immediately draft an evidence record.

"Create a new evidence record in the Evidence Hub named 'Q4 Cloud Infrastructure Access Review'. Set the initial status to pending."

List Organization Issues

Tool: list_all_diligent_org_issues

Queries all identified issues across active projects. Useful for generating remediation reports or checking if a specific control failure has already been logged as an issue.

"Fetch all open issues across our active projects. I need a summary of any issue related to 'improper access control'."

List Active Robots

Tool: list_all_diligent_org_robots

Retrieves the ACL robots running in your Diligent One Platform instance. These robots automate analytic scripts and scheduled tasks.

"Get a list of all active robots in our organization. I need to know the IDs of the robots responsible for financial continuous monitoring."

To see the complete tool inventory and JSON schemas for Diligent, visit the Diligent integration page.

Workflows in Action

Once connected, ChatGPT can sequence these tools to perform multi-step GRC operations. Here are two concrete scenarios showing how the LLM orchestrates Diligent's APIs.

Scenario 1: Automated Risk Assessment Updates

When a vulnerability scan completes or an incident occurs, a security engineer can ask ChatGPT to reconcile the event against the corporate risk registry.

"List our current strategy risks. Find the risk related to 'Cloud Infrastructure Vulnerability'. Once you find it, update its status to 'assess' and append a note that a new critical CVE was detected today."

Step-by-step execution:

1. list_all_diligent_org_strategy_risks: ChatGPT queries the strategy module and retrieves the JSON array of risks.
2. The LLM parses the array to locate the risk titled "Cloud Infrastructure Vulnerability" and extracts its id.
3. update_a_diligent_org_strategy_risk_by_id: ChatGPT invokes the update tool, passing the id, setting the status to assess, and updating the description string.
4. ChatGPT responds to the user: "I found the Cloud Infrastructure Vulnerability risk (ID: 4501). Its status has been changed to 'assess' and the description updated with the CVE note."

sequenceDiagram
  participant User as User (ChatGPT)
  participant MCP as Truto MCP Server
  participant Diligent as Diligent API

  User->>MCP: Call list_all_diligent_org_strategy_risks
  MCP->>Diligent: GET /strategy_risks
  Diligent-->>MCP: Array of risks
  MCP-->>User: JSON response
  Note over User: LLM finds ID 4501
  User->>MCP: Call update_a_diligent_org_strategy_risk_by_id (id: 4501, status: assess)
  MCP->>Diligent: PATCH /strategy_risks/4501
  Diligent-->>MCP: Updated risk object
  MCP-->>User: Success result

Scenario 2: Evidence Staging and Issue Correlation

During an active audit, an auditor needs to verify if evidence has been gathered for a known compliance gap, and if not, stage the evidence container.

"Check our active issues for anything titled 'Missing Q2 Access Logs'. If it exists, create a new evidence record in the Evidence Hub named 'Evidence for Q2 Access Logs' so we have a container ready for the uploads."

Step-by-step execution:

1. list_all_diligent_org_issues: ChatGPT fetches the list of active issues in the organization.
2. The LLM scans the issues array. It identifies the issue "Missing Q2 Access Logs" and notes its existence.
3. create_a_diligent_org_evidence: ChatGPT constructs the JSON body and calls the tool to create a new evidence record named 'Evidence for Q2 Access Logs'.
4. ChatGPT responds: "The issue 'Missing Q2 Access Logs' is currently active. I have created a new evidence record in the Evidence Hub titled 'Evidence for Q2 Access Logs' (ID: ev_8892) to stage the upcoming attachments."

Security and Access Control

Exposing an enterprise GRC platform to an LLM requires strict boundary controls. Truto's MCP architecture provides four layers of security to constrain what the AI agent can do:

• Method Filtering: When creating the server via the API or UI, you can set config.methods to ["read"]. This drops all POST, PATCH, PUT, and DELETE operations from the generated toolset. The LLM physically cannot mutate data; it can only query it.
• Tag Filtering: You can restrict the server to specific domains using config.tags (e.g., ["evidence", "strategy"]). The MCP server will only generate tools for Diligent endpoints that carry those tags, keeping the LLM entirely walled off from unrelated modules like robots or time_entries.
• Authentication (require_api_token_auth): By default, possessing the Truto MCP URL is sufficient to connect. For high-security environments, setting require_api_token_auth: true forces the connecting client to also supply a valid Truto API token in the Authorization header. If the header is missing, tool calls fail.
• Ephemeral Servers (expires_at): If you are running an automated audit workflow, you can set an expires_at ISO datetime when provisioning the server. Truto uses edge KV storage and durable time-to-live alarms to instantly and permanently destroy the server and its authentication metadata the moment the TTL expires.

Automate GRC at the Speed of Chat

Connecting Diligent to ChatGPT via MCP transforms how teams interact with GRC data. Instead of navigating through multiple modules in the One Platform UI to update risk statuses, correlate issues, or build evidence containers, security analysts and auditors can orchestrate the entire lifecycle via natural language.

By utilizing Truto as the managed MCP layer, you eliminate the operational burden of building JSON-RPC translations, handling authentication refreshes, and mapping complex relationship schemas. You define the boundaries, and the LLM handles the execution.