MCP.Market

Compliance Trestle MCP server

by oscal-compass·io.github.oscal-compass/compliance-trestle-mcp·v0.1.2·2 stars

An MCP server that provides tools to author OSCAL security compliance documentation

A89/100grade A
What users say
No reviews yet
Be the first
Safety scan
A89/100

full report

Adoption
New

2 stars

Reviews

Write one

Nobody has reviewed Compliance Trestle yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Compliance Trestle tools (6)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • trestle_author_catalog_generate
  • trestle_author_profile_assemble
  • trestle_author_profile_generate
  • trestle_author_profile_resolve
  • trestle_import
  • trestle_init

Public scan report

scanner v0.1.10 · 2026-09-28 · same rubric, same numbers if you re-run it

no findings
  • Code scan16 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 34 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
Overall 89/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Compliance Trestle compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
89/100
higher than 87% of 915 Security servers
Tools
6
the typical Security server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
2
more than 75% of 587 Security servers

What its tools let an agent do: 6 read

Install Compliance Trestle in Claude Code, Cursor or VS Code

claude mcp add compliance-trestle-mcp -- uvx compliance-trestle-mcp
Add to Cursor

What the publisher says

From the Compliance Trestle repository's README, as published. We do not edit it. Read it on GitHub

Trestle MCP

MCP server to easily use compliance-trestle (OSCAL tool) from Claude, Roo, or any MCP-compliant client.

mcp-name: io.github.oscal-compass/compliance-trestle-mcp

Getting Started

This project can be used in the following two ways:

  • Usage from Coding Agent (Roo Code): Use Trestle-MCP from Roo Code via MCP.
  • Usage from CLI (MCP Client): Invoke Trestle-MCP directly using an MCP CLI client.

Choose the option that best fits your workflow.

Usage from RooCode

  1. Add the following JSON to .roo/mcp.json (Roo workspace):
{
        "mcpServers": {
            "trestle": {
                "command": "uvx",
                "args": ["--from", "compliance-trestle-mcp", "trestle-mcp"]
            }
        }
    }
  1. Open Roo, confirm trestle tools are listed in the MCP panel, and execute as needed.

https://github.com/user-attachments/assets/59215549-cad9-4101-baa4-ecba77ac3904

Usage from CLI (MCP Client)

Step 1: Write your mcp.json config

{
    "mcpServers": {
        "trestle": {
            "command": "uvx",
            "args": ["--from", "./trestle-mcp-tmp", "trestle-mcp"]
        }
    }
}

Save this as mcp.json in your current directory.

Step 2: List Available Tools

uvx mcp-cli tools --config-file mcp.json

Sample output (tools available):

6 Available Tools
┌─────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────────────┐
│ Server  │ Tool                            │ Description                                                       │
├─────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────┤
│ trestle │ trestle_init                    │ Initialize a trestle working directory.                           │
│ trestle │ trestle_import                  │ Import an existing OSCAL model into the trestle workspace.        │
│ trestle │ trestle_author_catalog_generate │ Generate Catalog controls in markdown form from a catalog         │
│ trestle │ trestle_author_profile_generate │ Generate markdown documentation set for controls defined in profile│
│ trestle │ trestle_author_profile_resolve  │ Resolve an OSCAL profile to a resolved profile catalog.           │
│ trestle │ trestle_author_profile_assemble │ Assemble markdown controls into a Profile JSON file.              │
└─────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────────────┘

Step 3: Execute a Tool (e.g., trestle_init)

Start MCP interactive shell:

uvx mcp-cli interactive --config-file mcp.json

Then run, for example:

> execute trestle_init '{"params": {}}'

Typical result:

✓ ✅ Tool executed successfully
{
  "result": {
    ...
    "content": [
      {
        "type": "text",
        "text": "✅ Trestle workspace initialized successfully"
      }
    ]
  }
}

You'll see folders as follows:

assessment-plans    catalogs               plan-of-action-and-milestones  system-security-plans
assessment-results  component-definitions  profiles

Tool List & Quick Reference

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Compliance Trestle: common questions

Is Compliance Trestle MCP server safe?
Yes, by our scan: it is graded A (89/100). Read the Compliance Trestle safety report
How do I install Compliance Trestle?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Compliance Trestle need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Compliance Trestle maintained?
The last commit was 71 days ago (2026-08-25). The latest release is v0.1.2.
What can I use instead of Compliance Trestle?
Servers from other publishers that do the same job: Bastion MCP server, Fedramp Oscal Ssp Lint MCP server and Skylos MCP server.
How does Compliance Trestle compare with other Security MCP servers?
safety score 89/100 (higher than 87% of 915 Security servers); tools 6 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Compliance Trestle

Same job from other publishers: the closest match first, then the best rated.

  • Bastion
    Reliability + security proxy for MCP: runtime tool-security and a compliance-mapped audit trail.
    A
  • Fedramp Oscal Ssp Lint
    16 checks on a system-security-plan JSON, in your editor, before a validator returns the package
    A
  • Skylos
    Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
    C
  • Snyk
    Easily find and fix security issues in your applications leveraging Snyk platform capabilities.
    B
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A