MCP Server for OSCAL

<!-- mcp-name: io.github.awslabs/mcp-server-for-oscal -->

[![PyPI][pypi-badge]][pypi-url] [][pypi-url] [%22&replace=%241&label=OSCAL)][nist-oscal-url]

[pypi-badge]: https://img.shields.io/pypi/v/mcp-server-for-oscal.svg [pypi-url]: https://pypi.org/project/mcp-server-for-oscal/ [nist-oscal-url]: https://pages.nist.gov/OSCAL/ [mcp-spec-url]: https://modelcontextprotocol.io/docs/getting-started/intro [issues-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/ [new-issue-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/new

MCP Server for OSCAL

Instant OSCAL expertise for your favorite AI agent

A Model Context Protocol (MCP) server that provides AI assistants (Claude, Cline, Kiro, Claude Code, etc.) with tools to work with NIST's Open Security Controls Assessment Language (OSCAL). Like many early adopters, we needed help implementing OSCAL proofs-of-concept to demonstrate value to business stakeholders. Perhaps due to limited availability of examples in the public domain, we found that most AI agents/LLMs alone produced inconsistent results related to OSCAL. The tools in this MCP server minimized that problem for our use-case and we hope it does the same for you.

[!TIP]

To get started, see Installation below.

Features

Together, the tools provided by this MCP server are meant to enable your preferred AI assistant to provide accurate, authoritative guidance about OSCAL architecture, models, use-cases, requirements, and implementation. You don't need to understand the tools to use them, but details are in the tools directory.

The server is lightweight and meant to run locally without additional setup. By default, it uses stdio protocol for MCP transport. Do not attempt to use the server with streamable-http transport, as we've not yet implemented transport security or authentication.

The default tools should not connect to any remote services or resources - all required content is bundled with the server. As a security measure, we've implemented basic file integrity verification for bundled content. At build-time we generate manifests including SHA-256 hashes of all content files. Each time the server starts, all content files are verified against the hash manifests. Any mismatch should produce an error and prevent startup.

In addition to the MCP server, the package includes a standalone OSCAL agent built with Strands Agents. See the OSCAL Agent section below.

What is OSCAL?

OSCAL (Open Security Controls Assessment Language) is a set of framework-agnostic, vendor-neutral, machine-readable schemas developed by NIST that describe the full life cycle of GRC (governance, risk, compliance) artifacts, from controls to remediation plans. OSCAL enables automation of GRC workflows by replacing digital paper (spreadsheets, PDFs, etc.) with a standard-based structured data format. To learn more about OSCAL, install this MCP server then ask your AI. Or see the [official OSCAL website][nist-oscal-url].

Shortened. The full README is on GitHub.