Connect Kisi to ChatGPT: Automate Access & Security Monitoring

If you need to connect Kisi to ChatGPT to automate physical access control, monitor facility security, or orchestrate temporary access links, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's JSON-RPC tool calls and Kisi's REST API. You can either build and host this integration infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL in seconds.

If your team uses Claude, check out our guide on connecting Kisi to Claude or explore our broader architectural overview on connecting Kisi to AI Agents.

Giving a Large Language Model (LLM) read and write access to a physical security system like Kisi requires absolute precision. You are not just updating database records - you are unlocking physical doors, triggering facility-wide lockdowns, and auditing live camera streams. If your custom MCP server fails to parse the LLM's arguments correctly, the consequences impact physical security.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Kisi, connect it natively to ChatGPT, and execute complex facility workflows using natural language.

The Engineering Reality of the Kisi API

Building a custom MCP server means owning the entire API lifecycle. While the open MCP standard provides a predictable way for ChatGPT to discover tools, implementing it against a Physical Access Control System (PACS) like Kisi is exceptionally complex.

If you decide to build a custom MCP server for Kisi, here are the specific integration challenges your engineering team will inherit:

Deeply Nested Relational Access Models

Kisi's API does not have a single /grant-access endpoint. Physical access is highly relational. To grant a user access to a specific door, your MCP server must chain multiple endpoints. You have to map the User to a Member, associate that Member with a Group, ensure the Group is linked to a Place, and finally verify a GroupLock ties the physical Lock to that Group. If you expect ChatGPT to figure this out raw, it will hallucinate. Your MCP server must wrap these schemas perfectly so the LLM understands the relational taxonomy.

Cursor-Based Event Sets

When an AI agent needs to audit access logs (e.g., "Who opened the server room door today?"), it interacts with Kisi's events resource. Unlike standard offset pagination, Kisi uses event_sets - temporary cursor-based snapshots that persist for approximately 24 hours. Your custom MCP server must instruct the LLM on how to properly handle these short-lived cursors. If the LLM modifies or decodes the next_cursor string, the pagination fails entirely.

Rate Limits and Physical Latency

Physical hardware has latency. Unlocking a door or triggering a camera snapshot is not instantaneous. If ChatGPT retries a delayed request, it can trigger upstream rate limits. It is critical to understand that Truto does not retry, throttle, or apply backoff on rate limit errors. When Kisi returns an HTTP 429, Truto passes that error directly to the caller, normalizing the upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. Your AI agent framework is responsible for handling the backoff logic. Do not build an MCP server that swallows these errors - expose them so the agent knows to pause.

Kisi to ChatGPT Quickstart Guide

If you want the fastest path from a fresh Truto account to ChatGPT successfully executing commands against the Kisi API, follow these steps.

What you need:

• A Truto account with API access.
• A Kisi admin account capable of issuing API tokens.
• A ChatGPT Pro, Plus, Business, Enterprise, or Education seat with Developer mode enabled.

Step 1: Connect Kisi as an Integrated Account

First, we need to create the underlying connection to Kisi. Truto manages the credentials securely so your LLM never touches raw API keys.

In the Truto dashboard, navigate to Integrated Accounts -> New Integrated Account, select Kisi, and input your API token. Truto validates the connection and establishes the account.

Step 2: Grab your integrated_account_id

You can copy the ID directly from the Truto UI on the account detail page, or fetch it programmatically via the API:

curl https://api.truto.one/integrated-account \
  -H "Authorization: Bearer $TRUTO_API_TOKEN"

Step 3: Generate the Kisi MCP Server

Truto generates dynamic, documentation-driven MCP tools. You can create the server via the UI or the API.

Method A: Via the Truto UI

1. Navigate to the integrated account page for your Kisi connection.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Give it a name (e.g., "Kisi SecOps Agent").
5. Select your configuration (e.g., allow read and write methods, filter by tags if desired).
6. Copy the generated MCP server URL (it will look like https://api.truto.one/mcp/<token>).

Method B: Via the API Alternatively, you can provision the server programmatically. This single POST call scopes the endpoint, configures allowed methods, and returns the secure URL:

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ChatGPT Kisi Agent",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["locks", "places", "presences", "events"]
    }
  }'

The response contains a url field. Treat this URL as a secret - it contains the cryptographic token that routes requests directly to your specific Kisi instance.

Step 4: Connect the MCP Server to ChatGPT

Now, you must register this endpoint with your ChatGPT client. You can do this via the application settings or a configuration file.

Method A: Via the ChatGPT UI

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Toggle Developer mode on.
3. Under MCP servers / Custom connectors, click to add a new server.
4. Set the Name to "Kisi Security".
5. Paste the Truto MCP URL into the Server URL field.
6. Save. ChatGPT will immediately connect, handshake via JSON-RPC, and list the available Kisi tools.

Method B: Via Manual Config File If you are configuring a custom agent or using an environment that relies on the standard MCP config file, you can register the server using the SSE transport wrapper. Edit your MCP settings JSON file (often located at ~/Library/Application Support/mcp/config.json or similar, depending on your OS):

{
  "mcpServers": {
    "kisi-security": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/YOUR_SECURE_TOKEN_HERE"
      ]
    }
  }
}

Once connected, ChatGPT can instantly invoke operations on your facility hardware.

Core Kisi Tools for ChatGPT

By leveraging Truto's dynamic tool generation, your ChatGPT instance gains access to the full breadth of the Kisi API. Truto translates Kisi's schemas into flat LLM arguments, automatically injecting instructions for pagination and required fields.

Here are the highest-leverage hero tools for automating physical security:

list_all_kisi_locks

This tool retrieves the status of all locks in your organization. It returns crucial real-time state data, including whether a door is online, unlocked, or locked_down. It supports filtering by place_id or floor_id to narrow down the search.

"Get the current status of all locks on the 3rd floor. Are any of them currently offline or unlocked?"

kisi_locks_unlock

This is a custom action method that sends an immediate unlock signal to a specific hardware lock. It requires the lock_id and is frequently used by AI agents to grant remote access for vendors or employees who forgot their badges.

"Unlock the 'Main Lobby Entrance' door for the delivery driver who just arrived."

create_a_kisi_place_lock_down

In an emergency, this tool triggers a lockdown for an entire facility (a Place). A lockdown overrides schedules and normal access rules, physically securing all connected doors until a cancellation command is sent.

"We have a security alert. Trigger a lockdown immediately for the Austin Headquarters building."

list_all_kisi_presences

This tool queries the physical presence data for a specific place on a given date. It reveals exactly who entered the building, which lock they used last, and their first/last unlock times. It is invaluable for auditing and incident response.

"Pull the presence log for the Chicago office for yesterday. Who was the last person to leave the building?"

create_a_kisi_group_link

Provisioning a full user account for a visitor is overkill. This tool creates a temporary "Group Link" - a URL that grants a person temporary, time-bound access to a specific group of doors. It requires a name and a group_id, and accepts valid_from and valid_until windows.

"Generate a temporary access link for John Doe to access the 'Contractor Doors' group. Make it valid only for tomorrow between 9 AM and 5 PM."

get_single_kisi_camera_video_link_by_id

If your Kisi environment integrates with supported camera hardware (like Rhombus Systems), this tool fetches the live video stream URL for a specific camera ID. Agents can use this to provide security admins with immediate visual context.

"Get the live video feed link for the camera pointing at the Server Room door."

Note: Truto maps every available endpoint on the integration into MCP tools. For the complete list of operations, query schemas, and required parameters, visit the Kisi integration page.

Workflows in Action

Connecting an LLM to a Physical Access Control System enables autonomous security operations that previously required a human sitting at a dashboard. Here is how ChatGPT orchestrates real-world security tasks using Truto's MCP tools.

Scenario 1: Emergency Facility Lockdown

When a physical threat is detected, seconds matter. An IT admin can use ChatGPT to instantly secure a building and verify the hardware state.

"Lock down the San Francisco office immediately, then verify that all doors in that location successfully entered lockdown state."

Execution Steps:

1. list_all_kisi_places: ChatGPT queries the places list to find the exact place_id for the "San Francisco" office.
2. create_a_kisi_place_lock_down: The agent executes the lockdown custom method using the retrieved place_id.
3. list_all_kisi_locks: The agent passes place_id=<id> as a query parameter to fetch all doors in that office.
4. Analysis: ChatGPT iterates through the returned array, checking the locked_down boolean for each lock to confirm the command was physically acknowledged by the hardware, and reports the summary back to the admin.

sequenceDiagram
    participant Admin as IT Admin
    participant ChatGPT as ChatGPT
    participant Truto as Truto MCP
    participant Kisi as Kisi API

    Admin->>ChatGPT: "Lock down SF office & verify"
    ChatGPT->>Truto: call tool: list_all_kisi_places
    Truto->>Kisi: GET /places?query=San Francisco
    Kisi-->>Truto: Return Place ID 8899
    Truto-->>ChatGPT: Result: ID 8899
    
    ChatGPT->>Truto: call tool: create_a_kisi_place_lock_down (8899)
    Truto->>Kisi: POST /places/8899/lock_down
    Kisi-->>Truto: 204 No Content
    Truto-->>ChatGPT: Success
    
    ChatGPT->>Truto: call tool: list_all_kisi_locks (place_id=8899)
    Truto->>Kisi: GET /locks?place_id=8899
    Kisi-->>Truto: Array of Locks [locked_down: true]
    Truto-->>ChatGPT: Status verified
    ChatGPT-->>Admin: "San Francisco is locked down. All 14 doors confirmed secure."

Scenario 2: Investigating a Tailgating Incident

Security teams often need to correlate physical presence with visual evidence. If an unauthorized entry occurs, ChatGPT can aggregate the data.

"Someone reported a tailgating incident at the main entrance around 8:00 AM today. Find out who swiped in at that door this morning and get me the camera feed link for that entrance."

Execution Steps:

1. list_all_kisi_locks: ChatGPT searches for the lock named "Main Entrance" to get its id.
2. list_all_kisi_presences: The agent pulls today's presence log, analyzing the first_unlock_at timestamps to find the individual who unlocked the door at 8:00 AM.
3. get_single_kisi_camera_by_id: The agent queries the camera associated with that lock_id.
4. get_single_kisi_camera_video_link_by_id: ChatGPT retrieves the live stream URL and presents the name of the user who swiped, their timestamp, and the camera link to the security officer.

Scenario 3: Provisioning Temporary Vendor Access

Instead of logging into the Kisi dashboard, creating a user, assigning groups, and sending an email, an office manager can just tell ChatGPT to handle it.

"We have an HVAC repair tech arriving tomorrow. Create a temporary access link for them to access the Utility Rooms. Make it valid for tomorrow only, from 8 AM to 12 PM."

Execution Steps:

1. list_all_kisi_groups: ChatGPT finds the group_id for "Utility Rooms".
2. create_a_kisi_group_link: The agent generates the payload, calculating the ISO-8601 timestamps for tomorrow at 08:00 and 12:00 in the local timezone, and submits the POST request.
3. Response: ChatGPT returns the generated quick_response_code_token and URL to the office manager to text to the vendor.

Security and Access Control

Giving an AI agent the ability to unlock doors requires strict boundary control. Truto's MCP servers provide several architectural safeguards to ensure the agent operates within the principle of least privilege:

• Method Filtering (config.methods): You can restrict an MCP server to specific operation types. Setting methods: ["read"] ensures ChatGPT can only audit logs and view configurations. It physically prevents the LLM from executing create, update, delete, or custom methods (like unlock or lockdown).
• Tag Filtering (config.tags): You can restrict the server to specific operational domains. By setting tags: ["users", "events"], you prevent the LLM from even knowing that tools for interacting with locks or cameras exist.
• Time-to-Live (expires_at): For contractor agents or temporary security audits, you can attach an ISO datetime to the expires_at field. Once the timestamp is reached, Truto's infrastructure automatically revokes the token and shreds the server access.
• Secondary Authentication (require_api_token_auth): By default, the Truto MCP URL acts as a bearer token. For high-security environments, enabling require_api_token_auth: true forces the client to also pass a valid Truto API token in the Authorization header, adding a required secondary layer of identity verification.

Build Physical Automation Without the Integration Debt

Connecting Kisi to ChatGPT unlocks entirely new paradigms for physical security operations, IT administration, and facility management. However, building a custom MCP server to handle dynamic physical hardware, complex relational access models, and strict rate limits is an expensive distraction from your core product.

By using Truto, you eliminate the integration debt entirely. The tools are derived dynamically from documentation, pagination and error handling are normalized, and secure access boundaries are enforced at the infrastructure level. Your engineering team can focus on building intelligent agent workflows, while Truto handles the translation layer between the LLM and the physical door.