Connect Diligent to Claude: Orchestrate Audit Projects and Robots

If your team uses Claude to analyze audit evidence or automate compliance reviews, connecting it directly to Diligent transforms it from a passive chat interface into an active GRC orchestration engine. To do this securely, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's function calling capabilities and Diligent's REST APIs. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses ChatGPT, check out our guide on /connect-diligent-to-chatgpt-automate-risk-and-compliance-governance/ or explore our broader architectural overview on /connect-diligent-to-ai-agents-sync-evidence-and-results-analytics/.

Giving a Large Language Model (LLM) read and write access to a sprawling enterprise governance, risk, and compliance (GRC) platform like Diligent is a complex engineering challenge. You have to handle rigid authentication flows, map deeply nested JSON schemas to MCP tool definitions, and deal with Diligent's highly specific object hierarchies. Every time a new custom attribute is added or an endpoint is updated, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Diligent, connect it natively to Claude Desktop, and execute complex audit workflows using natural language.

The Engineering Reality of the Diligent API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against Diligent's APIs requires extensive domain knowledge. Diligent is not a simple CRUD app - it is a strict, hierarchical system designed to withstand regulatory scrutiny.

If you decide to build a custom MCP server for Diligent, here are the specific integration challenges you will face:

Strict Hierarchical Data Models Diligent HighBond enforces a rigid relationship structure. You cannot simply create a control or a risk in isolation. An Organization contains Projects. Projects contain Objectives. Objectives contain Risks and Controls. Controls require Test Plans. To create a single Control via the API, your LLM needs to navigate this entire tree, resolving the correct org_id, project_id, and objective_id before it can execute the target operation. A properly designed MCP server must expose discovery tools that allow Claude to traverse this hierarchy sequentially.

Cascading Entity Tags and Inherited Logic Diligent relies heavily on Entities (business units, departments, locations) to restrict data access and assign ownership. When you tag a Risk or a Control with an Entity using the API, Diligent automatically cascades that tag to all ancestor and descendant entities. However, you cannot remove inherited tags directly via the API. If your LLM attempts to issue a DELETE request against an inherited entity link, the API will reject it. Your tool descriptions must explicitly instruct the LLM on how Diligent's inheritance rules work to prevent hallucinated API calls that result in 400 Bad Request errors.

Asynchronous Diligent Robots (ACL Scripts) Diligent One Platform includes a module called Robots, which executes automated data analytics scripts (often written in Python or HighBond HCL). Triggering these scripts via the API is not a synchronous operation. When you call create_a_diligent_robot_task_run_now, you are simply placing a job in a queue. The API returns a job ID with a status of queued. The LLM must be equipped with tools to poll the job status and retrieve the output files once the status shifts to completed. Managing this async polling loop within an AI agent's context window requires careful schema design.

Rate Limits and 429 Handling Enterprise GRC platforms enforce strict rate limits to ensure platform stability during heavy audit seasons. It is critical to note how Truto handles these limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When an upstream API like Diligent returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The caller (your AI agent framework or Claude client) is strictly responsible for managing retry and backoff logic. Do not expect the integration layer to magically absorb rate limit errors.

Creating the Managed MCP Server

Instead of building a translation layer from scratch, Truto allows you to generate a fully managed MCP server endpoint. Truto derives the tool definitions dynamically from the underlying integration's documented API schema. If a Diligent endpoint is documented, it automatically becomes an AI-ready tool.

Method 1: Via the Truto UI

For administrators and non-developers, generating an MCP server takes seconds in the Truto dashboard.

1. Navigate to the Integrated Accounts page and select your connected Diligent instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Configure the server name, allowed methods (e.g., read-only or read/write), tag filters, and expiration date.
5. Copy the generated MCP Server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the API

For engineering teams building dynamic AI platforms, you can programmatically provision MCP servers for your end-users. Send a POST request to Truto to generate a secure, tokenized URL.

curl -X POST https://api.truto.one/integrated-account/{account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Diligent Audit Orchestrator",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["projects", "robots", "evidence"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The API returns a secure, hashed URL. The token in the URL encodes the specific Diligent account and the filtered toolset, making the endpoint fully self-contained for authentication.

Connecting the MCP Server to Claude

Once you have your Truto MCP Server URL, connecting it to Claude is a straightforward process.

Method 1: Via the Claude Desktop UI (and ChatGPT)

If you are using ChatGPT or Claude's web interface (depending on your plan's feature flags), you can add the URL directly in the settings.

1. In Claude Desktop, go to Settings -> Integrations (or Connectors).
2. Click Add MCP Server.
3. Paste the Truto MCP URL.
4. Click Add.

Claude will perform a handshake, run the tools/list initialization, and immediately understand the available Diligent tools.

Method 2: Via the Configuration File

For developers running custom Claude instances, Cursor, or local agents, you can configure the MCP server by modifying the claude_desktop_config.json file. Truto uses Server-Sent Events (SSE) to handle the JSON-RPC protocol over HTTP.

{
  "mcpServers": {
    "diligent-audit-orchestrator": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Save the file and restart your Claude Desktop client. The client will connect to Truto and populate the tools.

Hero Tools for Diligent

Truto exposes dozens of endpoints for Diligent, but these specific tools are the highest-leverage operations for AI agents orchestrating GRC workflows.

List Organization Projects

Retrieves the foundational containers for all audit and compliance work. The LLM uses this to find the project_id required for downstream tasks.

"Claude, list all active audit projects in our Diligent organization and find the one related to the Q3 SOX Compliance Audit."

Create a Project Issue

Logs a finding or deficiency directly into a project. This requires providing the org_id, project_id, and a structured payload detailing the risk.

"Based on the server logs I just provided, create a High-severity issue in the Q3 SOX project detailing the unauthorized root access event. Assign it to the IT Security group."

Trigger a Robot Task Run

Executes an automated analytics script within the Diligent One Platform. This bridges the gap between AI reasoning and deterministic data processing.

"Trigger the 'User Access Review' robot task for our organization. Let me know the resulting job ID so we can track its progress."

Upload Evidence

Allows the LLM to attach supporting files, such as policy documents or log extracts, to an Evidence Hub record.

"Take the firewall configuration policy we just revised and upload it as a new evidence record in Diligent to satisfy the network security control."

Manage Control Performance Schedules

Updates the schedule for recurring control tests. This is critical for keeping continuous monitoring frameworks aligned with changing business requirements.

"Update the control performance schedule for 'Quarterly Access Reviews' to run on a monthly frequency starting next week."

For a complete list of available operations, schemas, and required parameters, visit the Diligent integration page.

Workflows in Action

When Claude has access to these tools, it transitions from a generic chatbot to a context-aware GRC analyst. Here are two real-world scenarios showing how Claude navigates Diligent's strict data hierarchy.

Scenario 1: Logging a SOX Control Failure

An IT Auditor needs to log a deficiency found during a manual access review, assign a remediation action, and attach the evidence.

"Claude, I found a discrepancy in the Q3 SOX Audit project under the User Access objective. Log a new issue stating that three terminated employees retained VPN access. Then, create an action item assigned to IT Ops to revoke access immediately, and create a new evidence record placeholder for the termination logs."

Execution Steps:

1. get_single_diligent_org_project_by_id: Claude confirms the project exists and retrieves its structural metadata.
2. list_all_diligent_objectives: Claude finds the objective ID for "User Access".
3. create_a_diligent_project_issue: Claude posts the deficiency to the project.
4. create_a_diligent_issue_action: Claude creates the follow-up remediation task tied to the newly created issue ID.
5. create_a_diligent_org_evidence: Claude generates a new evidence record in the Evidence Hub for the upcoming logs.

sequenceDiagram
  participant Claude as Claude Desktop
  participant TrutoMCP as Truto MCP Server
  participant DiligentAPI as Diligent API

  Claude->>TrutoMCP: Call create_a_diligent_project_issue<br>with org_id and project_id
  TrutoMCP->>DiligentAPI: POST /projects/{id}/issues
  DiligentAPI-->>TrutoMCP: Issue ID 8922
  TrutoMCP-->>Claude: Return Issue ID
  Claude->>TrutoMCP: Call create_a_diligent_issue_action<br>using Issue ID 8922
  TrutoMCP->>DiligentAPI: POST /issues/8922/actions
  DiligentAPI-->>TrutoMCP: Action ID 441
  TrutoMCP-->>Claude: Action created successfully

Scenario 2: Orchestrating an Analytics Robot

A Data Analyst wants to run an ACL script that checks for duplicate vendor invoices and review the status.

"Claude, find the robot named 'Duplicate Invoice Checker' in our Diligent instance. Trigger its primary task to run immediately, and tell me the status of the job."

Execution Steps:

1. list_all_diligent_org_robots: Claude retrieves the list of robots and isolates the ID for the "Duplicate Invoice Checker".
2. list_all_diligent_robot_robot_tasks: Claude identifies the specific task ID associated with that robot.
3. create_a_diligent_robot_task_run_now: Claude triggers the execution, generating a new robot job.
4. list_all_diligent_robot_jobs: Claude checks the queue status of the job and reports back to the user.

flowchart TD
  A["list_all_diligent_org_robots<br>Find Robot ID"] --> B["list_all_diligent_robot_robot_tasks<br>Find Task ID"]
  B --> C["create_a_diligent_robot_task_run_now<br>Trigger Script"]
  C --> D["list_all_diligent_robot_jobs<br>Poll Status (Queued/Completed)"]

Security and Access Control

Exposing an enterprise GRC platform to an LLM requires rigorous security controls. Truto's MCP server architecture handles authentication and scoping at the infrastructure level, keeping your API keys secure.

• Method Filtering: You can configure the MCP token to allow only read operations (like get and list). This prevents the LLM from accidentally mutating audit records or deleting critical evidence during data discovery.
• Tag Filtering: You can restrict the MCP server to specific resource tags. For example, you can expose projects and issues but hide robots and time_entries.
• Require API Token Auth: By default, possessing the MCP URL grants access. For enterprise deployments, you can enable require_api_token_auth. This forces the client to pass a valid API session token in the authorization header, ensuring that only authenticated humans can utilize the AI agent.
• Time-to-Live (TTL): When provisioning an MCP server, you can set an expires_at timestamp. Truto automatically schedules a durable cleanup task. Once the timestamp passes, the database record and distributed KV cache entries are destroyed instantly, ensuring contractors or temporary agents do not retain perpetual access to your Diligent instance.

Moving Forward with Agentic GRC

Connecting Diligent to Claude via MCP eliminates the friction between unstructured human intent and strictly structured compliance databases. Instead of navigating dozens of nested menus to log an issue or trigger a script, your teams can orchestrate the entire platform through natural conversation.

By leveraging Truto's managed MCP architecture, you avoid the technical debt of hand-coding JSON schema mappings, managing OAuth token refresh cycles, and maintaining brittle API integrations. You simply configure the server, connect the model, and let Claude handle the heavy lifting of enterprise governance.