Compliance Trestle MCP server
io.github.oscal-compass/compliance-trestle-mcp·v0.1.2·2 starsAn MCP server that provides tools to author OSCAL security compliance documentation
2 stars
Reviews
Write oneNobody has reviewed Compliance Trestle yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Compliance Trestle tools (6)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
trestle_author_catalog_generatetrestle_author_profile_assembletrestle_author_profile_generatetrestle_author_profile_resolvetrestle_importtrestle_init
Public scan report
scanner v0.1.10 · 2026-09-28 · same rubric, same numbers if you re-run it
- Code scan16 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 34 days ago12/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
How Compliance Trestle compares
Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 89/100
- higher than 87% of 915 Security servers
- Tools
- 6
- the typical Security server has 6
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 2
- more than 75% of 587 Security servers
What its tools let an agent do: 6 read
Install Compliance Trestle in Claude Code, Cursor or VS Code
claude mcp add compliance-trestle-mcp -- uvx compliance-trestle-mcp
What the publisher says
From the Compliance Trestle repository's README, as published. We do not edit it. Read it on GitHub
Trestle MCP
MCP server to easily use compliance-trestle (OSCAL tool) from Claude, Roo, or any MCP-compliant client.
mcp-name: io.github.oscal-compass/compliance-trestle-mcp
Getting Started
This project can be used in the following two ways:
- Usage from Coding Agent (Roo Code): Use Trestle-MCP from Roo Code via MCP.
- Usage from CLI (MCP Client): Invoke Trestle-MCP directly using an MCP CLI client.
Choose the option that best fits your workflow.
Usage from RooCode
- Add the following JSON to .roo/mcp.json (Roo workspace):
{
"mcpServers": {
"trestle": {
"command": "uvx",
"args": ["--from", "compliance-trestle-mcp", "trestle-mcp"]
}
}
}- Open Roo, confirm trestle tools are listed in the MCP panel, and execute as needed.
https://github.com/user-attachments/assets/59215549-cad9-4101-baa4-ecba77ac3904
Usage from CLI (MCP Client)
Step 1: Write your mcp.json config
{
"mcpServers": {
"trestle": {
"command": "uvx",
"args": ["--from", "./trestle-mcp-tmp", "trestle-mcp"]
}
}
}Save this as mcp.json in your current directory.
Step 2: List Available Tools
uvx mcp-cli tools --config-file mcp.jsonSample output (tools available):
6 Available Tools
┌─────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────────────┐
│ Server │ Tool │ Description │
├─────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────┤
│ trestle │ trestle_init │ Initialize a trestle working directory. │
│ trestle │ trestle_import │ Import an existing OSCAL model into the trestle workspace. │
│ trestle │ trestle_author_catalog_generate │ Generate Catalog controls in markdown form from a catalog │
│ trestle │ trestle_author_profile_generate │ Generate markdown documentation set for controls defined in profile│
│ trestle │ trestle_author_profile_resolve │ Resolve an OSCAL profile to a resolved profile catalog. │
│ trestle │ trestle_author_profile_assemble │ Assemble markdown controls into a Profile JSON file. │
└─────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────────────┘Step 3: Execute a Tool (e.g., trestle_init)
Start MCP interactive shell:
uvx mcp-cli interactive --config-file mcp.jsonThen run, for example:
> execute trestle_init '{"params": {}}'Typical result:
✓ ✅ Tool executed successfully
{
"result": {
...
"content": [
{
"type": "text",
"text": "✅ Trestle workspace initialized successfully"
}
]
}
}You'll see folders as follows:
assessment-plans catalogs plan-of-action-and-milestones system-security-plans
assessment-results component-definitions profilesTool List & Quick Reference
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Compliance Trestle: common questions
- Is Compliance Trestle MCP server safe?
- Yes, by our scan: it is graded A (89/100). Read the Compliance Trestle safety report
- How do I install Compliance Trestle?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Compliance Trestle need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Compliance Trestle maintained?
- The last commit was 71 days ago (2026-08-25). The latest release is v0.1.2.
- What can I use instead of Compliance Trestle?
- Servers from other publishers that do the same job: Bastion MCP server, Fedramp Oscal Ssp Lint MCP server and Skylos MCP server.
- How does Compliance Trestle compare with other Security MCP servers?
- safety score 89/100 (higher than 87% of 915 Security servers); tools 6 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.
Alternatives to Compliance Trestle
Same job from other publishers: the closest match first, then the best rated.
- BastionReliability + security proxy for MCP: runtime tool-security and a compliance-mapped audit trail.not reviewedGrowingA
- Fedramp Oscal Ssp Lint16 checks on a system-security-plan JSON, in your editor, before a validator returns the packagenot reviewedGrowingA
- SkylosDead code, security, secrets detection and code quality for Python, TypeScript, Go.not reviewedEstablishedC
- SnykEasily find and fix security issues in your applications leveraging Snyk platform capabilities.not reviewedEstablishedB
- CrowdStrike Falcon MCP ServerConnects AI agents with CrowdStrike Falcon for security analysis and automation.not reviewedEstablishedA