Compliance Intelligence

com.theartofservicePublished by theartofservice.comOfficial publisherv1.1.0Updated Nov 2, 2026

What one compliance standard already evidences of another, with the reasoning and the rejections.

VerifiedStreamable HTTPWeb executableKnowledge & MemorySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Compliance knowledge graph MCP server for searching frameworks, controls and cross-framework mappings, plus a paid course catalogue and crosswalk reports.

What you can do
  • Search and read compliance frameworks, their domains and controls, and full-text search across the graph
  • Map controls between frameworks, check coverage of one standard against another, and inspect crosswalk provenance and refuted claims
  • Search a professional course catalogue by need, standard or teaching content, and read course modules and chapters
  • Build checkout links for courses, crosswalk reports and single-document compliance reviews
  • List adoption engagements and return adoption summaries and management reports for signed-in consultants
  • Show platform statistics and API pricing tiers
When to use it
Useful when an assistant has to reason about compliance standards: finding which controls a framework requires, what one standard already evidences of another, or which training covers overlapping programmes such as SOC 2 and ISO 27001.
Requirements
Remote streamable HTTP endpoint; the README describes anonymous access, with an optional API key (prefix tas_) from the provider's account settings for higher call limits. Some tools are paid per call over x402 in USDC on Base or free with a Professional API key. Adoption tools require a signed-in consultant account.
Before you install
Several tools are paid per call (cross-framework map, coverage report, refuted claims, combined coverage) and others return checkout links that lead to real purchases; the server itself does not take payment. Course and report purchases are completed at the linked store. Adoption tools expose engagement data tied to a signed-in account. Framework names containing slashes need the query-parameter variant of the controls tool.

Installation

In SourceWeft

  1. Open Compliance Intelligence in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.theartofservice%2Fcompliance-intelligence/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "compliance-intelligence": {
      "type": "http",
      "url": "https://api.theartofservice.com/mcp"
    }
  }
}

README

Compliance MCP Skill Example

[smithery badge]

A minimal, working example of an AI agent skill that uses the TheArtOfService Compliance MCP as its source-grounded knowledge layer.

The hosted server is listed on Smithery and in the official MCP registry as com.theartofservice/compliance-intelligence. Endpoint: https://api.theartofservice.com/mcp (streamable HTTP, anonymous access).

Two working examples: one for compliance research, one for the course catalogue. This is a reference implementation. Clone it, swap the framework name to whatever your agent needs, plug it into Claude / GPT / Copilot / your own agent runtime. Apache 2.0 licensed, no strings attached.

What this does

Given a compliance framework name (default: NIST SP 800-161), this script:

  1. Connects to the compliance API at https://api.theartofservice.com
  2. Pulls the framework metadata
  3. Pulls all controls in the framework
  4. For each control, fetches the auditor evidence requirements (categories, artefacts, common gaps, source citations)
  5. Generates a structured Markdown compliance brief

The output is suitable for piping into an LLM as context, or directly handing to an auditor or risk team.

Why this pattern works

The compliance corpus behind the API is source-grounded against the published standard text and human edited, not LLM-generated. That makes it the authoritative knowledge layer for any agent that needs to reason about compliance controls.

Your agent provides the tribal knowledge layer (the organization's specific context, the tone, the workflow). The platform provides the official knowledge layer. The split is what makes the resulting brief defensible.

Stats

  • 723 compliance frameworks
  • 20,400+ controls
  • 332,000+ cross-framework mappings
  • 314,000+ courses in the catalogue, searchable without a key
  • 28,586+ controls carry structured auditor evidence requirements
  • Source-grounded, version-tagged, refreshed weekly

Quickstart

bash
git clone https://github.com/GJB65/compliance-mcp-skill-example.gitcd compliance-mcp-skill-examplepip install -r requirements.txtcp .env.example .env# Edit .env and add your TAOS_API_KEY from https://compliance.theartofservice.com/settingspython run.py "NIST SP 800-161"

The script will print a Markdown brief to stdout. Redirect it to a file or pipe it into your downstream agent.

bash
python run.py "ISO 27001:2022" > iso_27001_brief.md

Second example: the course catalogue

run.py answers what does this framework require. find_courses.py answers the other half: what can the user actually do about it.

bash
python find_courses.py "soc 2 evidence collection"python find_courses.py "first 90 days as CISO" --framework "ISO 27001"python find_courses.py --overlap "SOC 2,ISO 27001"python find_courses.py --frameworks

No API key needed. The four catalogue tools are free and unmetered, because they exist to help a buyer find the right course rather than to meter access to data.

The interesting one is --overlap. A plain product listing cannot answer "we are running SOC 2 and ISO 27001 at the same time, what covers both", because that is a join, not a search. An organisation in that position does not want one course per standard, it wants the overlap:

# Courses covering SOC 2,ISO 27001 together
### SOC 2 Type 2 Security controls in ISO 27001- Price: $299.00 USD- Covers: ISO 27001, SOC 2- Buy: https://store.theartofservice.com/...

When nothing covers the whole combination, it says so and reports what exists per standard rather than returning an empty list.

Link buyers to the buy_url field. It carries attribution, which is how the catalogue knows an agent produced the sale.

Get an API key

  1. Sign up free at compliance.theartofservice.com/register.
  2. Your API key (prefix tas_) is in your account settings.
  3. Free tier: 100 calls/month. Professional ($49/mo): 10,000 calls/month plus overage at $0.005/call.
  4. For data licensing, white-label, or volume pricing, see the developer portal.

Using as a Claude skill

The SKILL.md file in this repo is structured as a Claude skill definition. Drop the repo into your Claude Code or Claude Desktop skills folder and Claude can invoke run.py directly with a framework name.

API endpoints used

This example hits the public REST agent API. The same data is available via the MCP endpoint at https://api.theartofservice.com/mcp if you prefer Model Context Protocol over REST.

EndpointUsed for
GET /api/agent/frameworks/{name}Framework metadata
GET /api/agent/frameworks/{name}/controlsAll controls in the framework
GET /api/agent/controls/{code}Full control detail including evidence_requirements
GET /api/agent/coursesSearch the course catalogue (free, no key)
GET /api/agent/courses-for-frameworksCourses covering two or more standards together
GET /api/agent/courses/{product_id}Full detail for one course
GET /api/agent/course-frameworksStandards covered, with course counts

Full tool catalog: compliance.theartofservice.com/developers

License

Apache 2.0. See LICENSE.

Contributions

Issues and PRs welcome. If you build a derivative skill (vendor risk, SOC 2 audit prep, framework-specific advisor, etc.) and want it linked from the example registry, open a PR with a one-line description and a repo URL.

Source: README.md at commit d2cb1a9

Tools

33

agent_search_courses

Search the course catalogue Find courses by need, framework, role or industry. Free-text search over the catalogue, optionally narrowed to a named standard. Examples: q='soc 2 evidence collection', q='first 90 days as CISO', q='data governance healthcare', or q='audit preparation' with framework='ISO 27001'. Returns up to 25 courses with a direct purchase URL. No authentication required. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersqrequiredlimitframework

agent_get_course

Get one course Full detail for a single course by product id, including every standard it covers and its purchase URL. Use after agent_search_courses to justify a recommendation. No authentication required. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersproduct_idrequired

agent_courses_for_frameworks

Find courses covering several standards at once Given two or more standards, returns courses that address ALL of them together, which is what an organisation running overlapping programmes actually needs. Example: frameworks='SOC 2,ISO 27001' returns courses on running both from one evidence set, rather than one course per standard. Falls back to reporting which standards have coverage if no single course spans them all. No authentication required. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterslimitframeworksrequired

agent_list_course_frameworks

List standards the catalogue covers Every standard that has courses, with a course count each. Use this to discover valid values for the framework filter before searching. No authentication required. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

agent_buy_course

Build a checkout for one or more courses Turn a course into a purchase. Give one or more product ids and this creates a real cart on the store and returns a checkout link that completes the sale. Free to call; the course price is paid at checkout. Use agent_search_courses to find the product id first. Multiple ids go in one cart, so a recommended set can be bought together in a single transaction. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersstoreproduct_idsrequired

agent_course_contents

What a course actually teaches, module by module FREE, no API key, no payment. The full teaching structure of one course: every module with its summary and every chapter inside it. Use it to confirm a course genuinely covers a requirement before recommending it to someone. The response carries buy_url, a direct purchase link for the course. Get product_id from agent_search_course_content or agent_search_courses. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersproduct_idrequired

agent_search_course_content

Search what courses teach, across the whole catalogue FREE, no API key, no payment. Full-text search over the TEACHING CONTENT of 126,803 professional courses: module titles, module summaries and every chapter title. Ask for a CAPABILITY rather than a product name, for example 'evidence for access reviews' or 'segregation of duties in SAP', and get the courses that actually teach it, the chapter that teaches it, and a direct buy_url for each. Use this when someone asks how to do something rather than what to buy. agent_search_courses matches product NAMES only; this matches what is inside them. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersqrequiredlimit

agent_signals_this_week

Funded rounds in the current window, filtered The genuine funded rounds, each with its source. Rows are already filtered: rate decisions, analyst price targets, bond issues, buybacks, parked domains, rumoured rounds and figures that were actually valuations are all excluded. The count of what was rejected is returned alongside, so the filtering can be argued with. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterslimitmin_usdfunctioninstrument

agent_capital_by_function

Capital by the business function it targets Where the money went, classified by whose job it changes. Sector labels describe the company; function labels describe the buyer. The second is the only one a reader can act on, which is why the classification is by function throughout. Concentration is reported when one deal carries a bucket, because a total can be arithmetically true and still mislead: one $1B debt facility once accounted for 73% of a function and 38% of a whole week. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

agent_controls_touched_by

Controls a funded capability actually touches The join. A capability, and the controls whose own text concerns it. Matched against the control's requirement text, never against its title alone: a title that reads like a familiar control is the most expensive kind of wrong match. Returns nothing rather than something strained when the capability finds no purchase, because a join that always finds something is worthless. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterslimitmin_hitsframeworkcapabilityrequired

agent_signal_exposure

Where a framework meets where the money is going A framework, a function, and the controls where the two meet. This answers the question the brief cannot answer for a reader, because it does not know who they are: money is moving into this capability, and here is what my own standard already asks of me about it. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterslimitfunctionframeworkrequired

agent_search_frameworks

Search and list compliance frameworks Search the compliance knowledge graph for frameworks by name, keyword, or jurisdiction. Returns framework metadata including name, description, jurisdiction, domain count, control count, and mapping-partner count. Without a query, returns all frameworks. Use this as the starting point to discover available frameworks. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersqlimitoffsetjurisdiction

agent_get_framework

Get detailed information about a compliance framework Returns comprehensive details about a specific compliance framework: description, jurisdiction, version, domains with control counts, and cross-framework mapping statistics. Use the exact framework name as returned by agent_search_frameworks. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersnamerequired

agent_get_framework_controls

Get all controls for a compliance framework Returns all controls belonging to a framework, optionally filtered by domain. Each control includes: code, title, description, and domain. For large frameworks (e.g. NIST SP 800-53 Rev 5), use the domain filter to narrow results. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersnamerequireddomain

agent_get_framework_controls_by_name

Get all controls for a framework, naming it as a query parameter Identical to agent_get_framework_controls, taking the framework name as a query parameter instead of a path segment. Use this whenever the framework name contains a forward slash. 84 of the frameworks in the graph do, including CCPA/CPRA, AML/CTF Act 2006 and BSA/AML, and the path form cannot reach any of them: the server decodes %2F back to a real separator before routing, so the request 404s no matter how it is encoded. This route has no such problem and works for every framework. Free, no authentication. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersnamerequireddomain

agent_get_control

Get detailed information about a specific control Returns full details for a single control by its code identifier: title, description, domain, and framework. Control codes are framework-specific (e.g. 'A.5.1' for ISO 27001, 'AC-1' for NIST 800-53). ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterscoderequired

agent_get_control_cross_references

Get cross-framework mappings for a control Returns all controls in other frameworks that map to the given control via MAPS_TO relationships. This is the core cross-framework mapping capability: use it to find equivalent controls across different compliance frameworks (e.g. NIST 800-53 equivalents of ISO 27001 controls). ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterscoderequired

agent_cross_framework_map

Map controls between two compliance frameworks PAID PER CALL, $0.015 over x402 (USDC on Base); a Professional API key is served free instead. Free without payment or key: agent_crosswalk_pairs, agent_search_frameworks. Returns the complete control-to-control mapping between a source and target framework. Each mapping shows which source control maps to which target control(s). This enables multi-framework compliance: satisfy one control to cover requirements in both frameworks. Use exact framework names as returned by agent_search_frameworks. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterssourcerequiredtargetrequired

agent_coverage_report

Get cross-framework coverage report for a framework PAID PER CALL, $0.015 over x402 (USDC on Base); a Professional API key is served free instead. Free without payment or key: agent_crosswalk_pairs, agent_search_frameworks. Returns a coverage analysis showing how many controls in the given framework map to controls in every other framework. Includes total controls, mapped control counts, and coverage percentages per target framework. Use this to understand which frameworks overlap most and plan multi-framework strategies. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersnamerequired

agent_platform_stats

Get platform statistics Returns current platform statistics: total framework count, control count, cross-framework mapping count, and domain count. No authentication required. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

agent_pricing_info

Get API pricing and rate limit information Returns current API pricing tiers, monthly call limits, and (if authenticated) your current month's usage. Use this to understand costs before making API calls. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

agent_coverage_crosswalk

What one framework already evidences of another Given a framework you already hold and one you are working toward, returns which of the target's controls your existing evidence already covers, which remain as gaps, and the reasoning for every claim. Example: source='SOC 2', target='ISO 27001:2022'. Mappings are derived judgements, not text lifted from either standard, and each has survived an adversarial verification pass. Where no mappings exist between the pair, the response says so explicitly rather than reporting zero coverage, because an absence of data is not a coverage of zero. PAID PER CALL, $0.015 over x402 (USDC on Base). Called without payment it answers 402 with a PAYMENT-REQUIRED challenge carrying the amount, asset and address; a Professional API key is served free instead. Free without payment or key: agent_crosswalk_pairs lists every released pair, agent_search_frameworks and agent_get_framework cover the catalogue. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterssourcerequiredtargetrequiredmin_confidence

agent_crosswalk_provenance

How do you know this: the grounding behind a crosswalk's claims For any released framework pair, return the reasoning and the provenance behind its mappings: what document each control was verified against, when, who judged the mapping, on what date, and whether it survived an adversarial pass that argued against it. PAID PER CALL, $0.015 over x402 (USDC on Base); a Professional API key is served free instead. A claim you cannot check is worth nothing, so the checking is not the paid part. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterslimitsourcerequiredtargetrequired

agent_crosswalk_pair

Everything about one crosswalk pair, including what was rejected One framework pair in full: the coverage percentage and how it was arrived at, a sample of the claims that held with the reasoning behind each, and a sample of the claims that were proposed and refuted with the reason each failed. The rejected claims are part of the answer, not an appendix. A coverage number quoted without them is a number nobody argued with. PAID PER CALL, $0.015 over x402 (USDC on Base). Called without payment it answers 402 with a PAYMENT-REQUIRED challenge carrying the amount, asset and address; a Professional API key is served free instead. Free without payment or key: agent_crosswalk_pairs lists every released pair, agent_search_frameworks and agent_get_framework cover the catalogue. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterslimitsourcerequiredtargetrequired

agent_crosswalk_refuted

What was claimed and did not hold, with the reason PAID PER CALL, $0.015 over x402 (USDC on Base); a Professional API key is served free instead. Free without payment or key: agent_crosswalk_pairs, agent_search_frameworks. The mappings that were proposed for a pair and then refuted, each with why it failed. Refuted mappings are kept in the graph rather than deleted, so what was rejected is as inspectable as what survived. This is the check worth running on any coverage claim: a crosswalk that never rejects anything is not being judged. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parameterslimitsourcerequiredtargetrequired

agent_combined_coverage

What everything you already hold covers, together PAID PER CALL, $0.015 over x402 (USDC on Base); a Professional API key is served free instead. Free without payment or key: agent_crosswalk_pairs, agent_search_frameworks. Give the frameworks an organisation already holds and one it needs. Returns what they cover TOGETHER, what each one adds that the others do not, and what none of them reaches. No organisation holds one certification, and the marginal number is the one worth knowing: a second and third certification often add far less than expected. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersholdsrequiredtargetrequired

agent_buy_crosswalk

Get a checkout link for a crosswalk report Returns a payment link for the crosswalk between two frameworks. Released pairs are delivered immediately on payment; any other pair is built to order at the same price. This returns a LINK, it does not take payment. An agent hands the link to whoever it is acting for. No card details pass through the agent. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

agent_buy_review

Get a checkout link for a single document compliance review Returns a payment link for a Single Document Compliance Review against one framework. On payment the buyer is emailed a single-use link that opens the same automated pipeline a Professional subscriber uses: upload one PDF or Word document, get back a gap analysis naming every control the document addresses and every one it does not, and a rewritten version drafted against those gaps. This returns a LINK, it does not take payment. An agent hands the link to whoever it is acting for. No card details pass through the agent. It produces draft policy language and a gap list. It does not make anyone compliant, and no tool can: that judgement is an assessor's. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

agent_list_crosswalk_pairs

Framework pairs with a released coverage crosswalk Lists the framework pairs that have a reviewed, signed-off coverage crosswalk, with the coverage figure for each. Call this before agent_coverage_crosswalk to find out which pairs return a number. A pair that is not listed here has not been through review. Asking for it returns an honest 'not released' rather than an unreviewed percentage. Any pair across the any framework pair in the graph can be built to order, one pair being one unit of work. No authentication required. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

adoption_list_engagements

List Engagements Every adoption engagement the signed in consultant runs, with its current state. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Takes no parameters.

adoption_get_adoption_summary

Adoption Summary Adoption against baseline for one engagement: overall, by process area, and movement. Says whether the baseline was measured or reconstructed from artefacts, and whether the two waves are comparable at all. A pulse that used a different question set is reported as not comparable rather than differenced, because the difference would be between two rulers rather than two measurements. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersengagement_idrequired

adoption_get_report

Get Report The latest management report as facts plus the evidence behind each one. Returns the fact sheet, not the rendered page. Every figure carries the responses or the uploaded file it came from, so a claim can be checked rather than repeated. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Parametersengagement_idrequired

Version history

1
  1. v1.1.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts