Introducing the DocTract MCP Server: trusted, permission-aware Policy answers inside Microsoft Copilot and other AI assistants.
An employee asks Copilot whether unused vacation days carry over. A manager asks an AI assistant whether a client dinner fits the expense Policy. A supervisor on the floor asks how often a safety inspection has to be logged.
The AI will answer every time. The only question is whether the answer is right.
In our recent OCEG webinar, AI Is Putting Your Policies and Procedures Center Stage, DocTract CEO David Munro explored how AI is pulling Policies out of the repository and into everyday decisions, and why the "easy" approaches create real risk. Today we're introducing a capability that puts those lessons into practice: the DocTract MCP Server.
The Shortcuts That Create Risk
When organizations want AI to answer Policy questions, the fastest options are often the riskiest:
- Exporting the Policy library into another system creates copies that start going stale the moment a Policy is revised.
- Pasting Policies into a chat leaves no control over which version was used or who should have seen it.
- Letting the AI rely on what it already knows produces confident answers that may have nothing to do with your actual Policies.
Each shortcut breaks something your Policy program depends on: version control, access control, or the ability to prove where an answer came from. As we put it in the webinar: "AI doesn't fix a broken process. It ruins it faster."
What Is an MCP Server?
The Model Context Protocol (MCP) is an open standard that lets AI assistants connect securely to the business systems that hold your information. Think of it as a universal adapter. Instead of building a separate integration for every AI tool, a system offers an MCP server, and any compatible assistant can use it to look up information when a question calls for it.
For Policy Management, that changes the equation. Your AI assistant doesn't need its own copy of your policies. It can ask DocTract at the moment a question is asked and get the relevant content straight from the source.
Introducing the DocTract MCP Server
The DocTract MCP Server gives AI assistants such as Microsoft Copilot a secure, live connection to the Policies, Procedures, standards, forms, and work instructions you publish in DocTract.
When an employee asks a Policy question, the assistant searches DocTract on that employee's behalf. DocTract returns the most relevant excerpts, along with each document's name, number, and a link to the official document. The assistant answers from that content and cites its sources.
How It Works
- Connect once. Your administrator connects DocTract to your organization's identity provider, such as Microsoft Entra ID, and adds the DocTract MCP Server to your AI assistant.
- Ask naturally. Employees ask questions in plain language, in the assistant they already use.
- Search securely. DocTract searches only the current published documents that employee is allowed to see.
- Answer with sources. The assistant responds with an answer grounded in your Policies, with links back to the official documents.
Built for Governance, Not Just Convenience
Making Policies easy to reach is only half the job. The DocTract MCP Server was designed around the controls your policy program already relies on.
Always the current, approved version
There's nothing to export, upload, or resync. Every search runs against the documents published in DocTract at that moment, so when a Policy is revised and republished, AI answers reflect the new version.
Permission-aware by design
Employees sign in with their existing organizational identity. DocTract matches each person to their DocTract account and applies the same access rules as your DocTract document portal, so a department-specific procedure stays with the people who are meant to see it.
Cited and verifiable
DocTract guides connected assistants to answer only from the content DocTract returns, cite each document by name and number with its link, and say plainly when no relevant Policy was found. Employees can open the official document directly from the citation.
Read-only and under your control
The connection can search published content, but it can't create, edit, or delete anything. Administrators decide which identity providers can connect and can switch a connection off at any time.
Tuned to your organization
Every organization has its own vocabulary. Administrators can add organization-specific guidance, such as "our Procedures use the SOP- prefix," to help assistants search your library more effectively.
Visibility into what employees look for
Searches made through AI assistants appear in DocTract's portal search analytics alongside portal searches. Policy owners can see which topics employees search for and spot searches that return no results, a practical signal of where Policy content may need attention.
Safeguards against manipulation
DocTract instructs connected assistants to treat document content as information, never as instructions. That helps guard against attempts to steer an AI through text hidden in a document.
What It Looks Like in Practice
Illustrative example. The Policy below is fictional.
Employee: Can I carry over unused vacation days into next year?
AI assistant: Yes, within a limit. According to the Paid Time Off Policy (HR-104), you can carry over up to five unused days into the next calendar year. Any additional days are forfeited unless HR approves an exception.
Source: Paid Time Off Policy (HR-104) — Open in DocTract ↗
The employee gets a direct answer in seconds. The Policy owner knows it came from the approved version. And if the employee needs the full context, the official document is right there.
What It Means for Your Teams
- Employees get quick, trustworthy answers without leaving the tools they work in.
- Policy and compliance owners know answers come from the approved version and can see where employees need more clarity.
- IT and security teams keep authentication in their own identity provider, enforce existing permissions, and avoid copying sensitive documents into yet another system.
- Leadership gains the productivity of AI without giving up the governance the Policy program was built on.
Part of DocTract AI
The DocTract MCP Server extends DocTract AI, which already brings AI-powered portal search, intelligent document analysis, and AI-assisted drafting to the DocTract platform. DocTract AI helps your team create and maintain trusted Policies. The DocTract MCP Server makes sure that trusted content is what employees see when they ask an AI assistant.
MCP is an open standard, so you can use the MCP-compatible assistant your organization has already approved. DocTract supplies the trusted Policy content without adding another AI model in the middle.
Frequently Asked Questions
What is the DocTract MCP Server?
A secure connection, built on the open Model Context Protocol, that lets AI assistants search your published Policies and Procedures in DocTract and answer questions with citations to the official documents.
Which AI assistants can connect?
MCP-compatible AI assistants that sign users in through your organization's identity provider, such as Microsoft Copilot. Contact us to confirm support for the assistant you use.
Do we need to export or upload our Policies?
No. The assistant searches DocTract directly whenever a question is asked, so answers reflect your currently published documents.
Will employees see Policies they aren't permitted to see?
No. Each employee signs in with their own organizational identity, and DocTract returns only the published documents that person is authorized to access.
Can the AI assistant change our Policies?
No. The DocTract MCP Server is read-only.
Does DocTract send our Policies to an AI model?
When an employee asks a question, DocTract returns only the relevant excerpts that employee is allowed to see, and only to the AI assistant your organization connected. DocTract doesn't route the request through any additional AI model.
Get Started
The DocTract MCP Server is available now as an add-on for DocTract customers. Schedule a demo to see trusted Policy answers in action, or contact us to add it to your DocTract subscription.
AI is already answering your employees' Policy questions. Make sure it's answering from the source.