Coso Mcp

com.ascent-partnersPublished by ascent-partners.comOfficial publisherv0.1.2Updated Oct 25, 2026

Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.

VerifiedStreamable HTTPWeb executableData & Analytics Business & Commerce

Server details

Identifier: com.ascent-partners/coso-mcp
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Oct 14, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to ascent-partners.com, which also runs its endpoint. That identifies the publisher; it does not make the server's tools safe.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/com.ascent-partners%2Fcoso-mcp.svg)](https://sourceweft.com/mcp/com.ascent-partners%2Fcoso-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

An open MCP server for running COSO internal-control reviews, from scoping and risk assessment through sampling, testing, workpapers and deficiency reporting.

What you can do: Look up COSO framework reference material: components, principles, objective categories and assertions, plus coverage checks per principle and component and a framework integration check. Create and manage review engagements, scope items, risks and controls, with an append-only audit log per engagement. Compute sample sizes, register populations, select reproducible samples and record test results and exceptions. Assemble Markdown workpapers, add and resolve reviewer notes, and record preparer/reviewer sign-off. Classify and aggregate deficiencies, then generate a Markdown review report.
When to use it: Useful when an assistant is helping plan or document an internal-control or ICFR review under COSO ICIF-2013 and needs structured, traceable records rather than freeform text. The hosted endpoint suits trying the full lifecycle without setup; the local package suits repeat use in a client.
Requirements: Either the hosted streamable HTTP endpoint or a local process run with npx from the npm package @simonmak-ascent/coso-mcp over stdio, which needs Node.js. No account, API key, environment variable or header is declared. Network access is needed for the hosted endpoint.

Before you install

The README states it is not audit or legal advice and that workpapers and assessments must be reviewed by qualified professionals before use in audit documentation. Write tools create engagements, risks, controls, samples, test results, sign-offs and deficiencies; on the hosted endpoint these run in an ephemeral per-session sandbox and are not persisted, so nothing survives the session. Sign-off warns on same-person independence.

Installation

In SourceWeft

Open Coso Mcp in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.ascent-partners%2Fcoso-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "coso": {
      "type": "http",
      "url": "https://internal-control.ascent-partners.com/mcp"
    }
  }
}

README

coso-mcp

[npm] [license: MIT] [MCP]

An open Model Context Protocol server for internal-control reviews under the COSO Internal Control—Integrated Framework (ICIF-2013). It covers the full review lifecycle — scope → risk assessment → control register → population → sampling → testing → workpapers → review sign-off → deficiency evaluation → report — grounded in the framework's 5 components, 17 principles and points of focus.

Local: runs over stdio (npx @simonmak-ascent/coso-mcp).
Hosted: public endpoint at https://internal-control.ascent-partners.com/mcp (reference + read tools, plus an ephemeral per-session sandbox for the full write lifecycle — nothing persists).

Not audit or legal advice. This server assists with internal-control review methodology. All workpapers and assessments must be reviewed by qualified professionals before use in audit documentation.

Why this exists (competitive advantage)

Existing MCP servers either expose a vendor's GRC records (read-mostly, proprietary, product-shaped) or cover ISO 27001 / security controls. None runs a traceable COSO review. coso-mcp is the first COSO/ICFR-native, write-capable, open MCP for the whole lifecycle.

Dimension	coso-mcp	Vendor GRC MCPs (Workiva, Vanta, Drata, Optro, OpenPages, LogicGate…)	Community MCPs (iso27001-mcp, unidoc/isms, mcp-server-scf…)	AI skills (sox-testing / audit-support)
COSO ICIF-2013 native (5 components / 17 principles / points of focus)	✅ core engine	❌ product objects	❌ ISO/SCF-shaped	⚠️ text only
Full lifecycle to signed workpaper	✅	❌ retrieval; Workiva GRC tools are read-only	❌ planning/findings at best	⚠️ templates, not executable
Write/stateful workpapers + preparer/reviewer sign-off + audit trail	✅	❌ mostly read	❌	❌
Framework effectiveness (principle/component present & functioning)	✅	❌	❌	❌
Deterministic, reproducible computation (sample-size tables, seeded selection)	✅	partial	❌	❌ (freeform)
Open source + open access (MIT, public endpoint, no account)	✅	❌ paid platform	⚠️ some OSS	⚠️ not a server

Moat: it is the lifecycle layer, not the data layer — it can sit on top of Workiva/Vanta/Drata rather than compete for their data; its sampling and deficiency math are computed, not improvised; and openness gives zero-friction distribution no gated vendor can match.

Tools

Tool	Kind	Purpose
`get_server_info`	read	Server identity, framework coverage, disclaimer.
`list_components`	read	The five COSO components.
`list_principles`	read	The 17 principles (optionally filtered by component).
`get_principle`	read	A principle by number or slug, with paraphrased points of focus.
`get_component`	read	A component by id, with its principles.
`list_objective_categories`	read	Operations / reporting / compliance.
`list_assertions`	read	The CEAVOP assertions used to frame control objectives.
`create_engagement`	write	Create a review engagement.
`get_engagement`	read	Get an engagement by id.
`list_engagements`	read	List engagements.
`add_scope_item`	write	Add a significant account/process to scope.
`list_scope_items`	read	List scope items.
`register_risk`	write	Register a risk to objectives (likelihood, assertions, principles, fraud).
`list_risks`	read	List registered risks.
`register_control`	write	Register a control (type, frequency, linked risks, assertions).
`list_controls`	read	List registered controls.
`get_audit_log`	read	Append-only audit events for an engagement.
`compute_sample_size`	read	Recommended sample size from frequency × risk, with rationale.
`create_population`	write	Register a population (item list or declared size, bounded).
`list_populations`	read	List populations.
`select_sample`	write	Seeded, reproducible sample selection (random/systematic/targeted/haphazard).
`record_test_result`	write	Record attribute-level outcomes (pass/fail/na) and a conclusion.
`list_test_results`	read	List test results.
`note_exception`	write	Record an exception with root cause and impact.
`list_exceptions`	read	List exceptions.
`assemble_workpaper`	write	Assemble a Markdown control-testing workpaper.
`list_workpapers`	read	List workpapers.
`get_workpaper`	read	Get a workpaper with its Markdown.
`add_review_note`	write	Add a reviewer note.
`resolve_review_note`	write	Resolve a reviewer note.
`sign_off`	write	Preparer/reviewer sign-off (warns on same-person independence).
`get_activity_log`	read	Append-only activity log for an engagement.
`classify_deficiency`	write	Classify a deficiency (deficiency / significant / material weakness).
`list_deficiencies`	read	List deficiencies.
`aggregate_deficiencies`	read	Group and flag deficiencies that may aggregate.
`assess_principle`	read	Coverage indicators for one COSO principle.
`assess_component`	read	Coverage indicators for one COSO component.
`framework_integration_check`	read	Check all five components have coverage.
`generate_report`	read	Generate the Markdown review report.

Resources: coso://framework/icif-2013 (framework reference), coso://engagement/{id} (engagement bundle: scope, risks, controls). Prompts: scope-review, assess-risk, build-control-matrix, draft-test-workpaper, evaluate-deficiencies.

Usage

Local (stdio)

Claude Desktop / generic MCP client config:

json

{  "mcpServers": {    "coso": {      "command": "npx",      "args": ["-y", "@simonmak-ascent/coso-mcp"]    }  }}

{  "mcpServers": {    "coso": {      "command": "npx",      "args": ["-y", "@simonmak-ascent/coso-mcp"]    }  }}

Hosted (streamable HTTP)

The hosted endpoint is open. Write operations run in an ephemeral, isolated, rate-limited per-session sandbox and are not persisted.

Development

Compute runs on a box, never locally: cs run "<cmd>".

Security

See SECURITY.md. Report vulnerabilities privately — do not open a public issue.

Contributing

See CONTRIBUTING.md and the Code of Conduct.

License

MIT © Simon Mak / Ascent Partners Group Limited.

Source: README.md at commit 7a147fc

Tools

SourceWeft has not read this server's tools yet.

Version history

v0.1.2LatestOct 14, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts

Other Ascent-Partners integrations

Startup Valuation MCP Server

com.ascent-partnersOfficial publisher

Computes startup valuations: 14 tools covering 80+ pre-revenue, industry and equity formulas, run locally or as a hosted endpoint.

Streamable HTTPWeb executable

Finance14 toolsNov 4, 2026

Intangible Asset Valuation MCP Server

com.ascent-partnersOfficial publisher

Computes intangible asset valuations — IP, technology, goodwill, PPA and impairment — through 14 tools covering 124+ textbook formulas.

Streamable HTTPWeb executable

Finance14 toolsOct 24, 2026

HKEx Filings

com.ascent-partnersOfficial publisher

Read-only MCP access to live Hong Kong Stock Exchange filings: search by date window, browse facets, and download and extract document text and tables.

Streamable HTTPWeb executable

Web Search & Scraping4 toolsNov 4, 2026

Fair Value MCP Server

com.ascent-partnersOfficial publisher

Financial valuation MCP server with 14 calculate_* tools covering DCF, WACC, options, credit risk, actuarial and structured products, with IFRS/IVS citations.

Streamable HTTPWeb executable

Finance14 toolsOct 24, 2026

Vision Driven Design (VDD) MCP Server

com.ascent-partners

A spec-driven development MCP server that guides an assistant through eight phases, from project constitution to validated, traceable specs and tasks.

Streamable HTTPWeb executable

Productivity & Workflow15 toolsOct 24, 2026