MCP Server for OSCAL

io.github.awslabs由 GitHub 账号 awslabs 发布v0.4.0更新于 Nov 3, 2026

AI agent tools for Open Security Controls Assessment Language (OSCAL)

已验证STDIO仅桌面知识与记忆安全与监控

服务详情

标识符: io.github.awslabs/mcp-server-for-oscal
传输: STDIO
运行时: Desktop only
信任: Verified
发布于: Sep 16, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此条目所属的 GitHub 账号 awslabs。这并不表明该账号就是产品方。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.awslabs%2Fmcp-server-for-oscal.svg)](https://sourceweft.com/mcp/io.github.awslabs%2Fmcp-server-for-oscal?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

本地 MCP 服务器，为 AI 助手提供处理 NIST OSCAL 合规模型、架构与目录的工具及内置参考资料。

可以做什么: 列出 OSCAL 模型及其状态，并获取 JSON 等格式的模型架构
浏览内置的 OSCAL 资源、文档与开源目录
查询和列出内置 AWS 组件定义中的组件，可按 UUID 或定义筛选
索引自有的 OSCAL JSON 文件（目录、SSP、配置文件、评估计划与结果、POA&M、映射集合），并与内置内容一起查询
启动时用 SHA-256 清单校验内置内容
适用场景: 适合在起草或校验 OSCAL 制品（目录、配置文件、SSP、评估计划、映射集合等）时，让助手依据权威架构和示例工作而非凭空生成。也适合了解 OSCAL 各模型之间的关系。
运行要求: 以 stdio 在本地运行；以 Python 包形式发布在 PyPI，通过 uvx 启动，需要 uv 包管理器和 Python 3.11 或更高版本。默认工具无需任何凭据。可选变量：OSCAL_DOCUMENTS_DIR、OSCAL_STORE_DB_PATH、OSCAL_STORE_CACHE_SIZE。随附的独立 agent 需要 AWS Bedrock 访问权限，使用 AWS_PROFILE、AWS_REGION 和 BEDROCK_MODEL_ID。

安装前请注意

README 说明 streamable-http 传输尚未实现身份验证或传输安全，应使用 stdio。随附 agent 会把查询发送到 AWS Bedrock，并可能将会话历史保存在本地文件或 S3 存储桶中。将 OSCAL_DOCUMENTS_DIR 指向某目录后，服务器会索引其中找到的所有 JSON 文件。部分示例配置会自动批准所有工具。

安装

在 SourceWeft 中

打开控制台中的 MCP Server for OSCAL，将其添加到工作区。
为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照仓库中的启动说明。

README

[Build Status] [Version] [PyPI - Python Version] [PyPI] [PyPI - Downloads] [OSCAL] [GitHub License]

MCP Server for OSCAL

Instant OSCAL expertise for your favorite AI agent

A Model Context Protocol (MCP) server that provides AI assistants (Claude, Cline, Kiro, Claude Code, etc.) with tools to work with NIST's Open Security Controls Assessment Language (OSCAL). Like many early adopters, we needed help implementing OSCAL proofs-of-concept to demonstrate value to business stakeholders. Perhaps due to limited availability of examples in the public domain, we found that most AI agents/LLMs alone produced inconsistent results related to OSCAL. The tools in this MCP server minimized that problem for our use-case and we hope it does the same for you.

[!TIP] To get started, see Installation below.

Features

Together, the tools provided by this MCP server are meant to enable your preferred AI assistant to provide accurate, authoritative guidance about OSCAL architecture, models, use-cases, requirements, and implementation. You don't need to understand the tools to use them, but details are in the tools directory.

The server is lightweight and meant to run locally without additional setup. By default, it uses stdio protocol for MCP transport. Do not attempt to use the server with streamable-http transport, as we've not yet implemented transport security or authentication.

The default tools should not connect to any remote services or resources - all required content is bundled with the server. As a security measure, we've implemented basic file integrity verification for bundled content. At build-time we generate manifests including SHA-256 hashes of all content files. Each time the server starts, all content files are verified against the hash manifests. Any mismatch should produce an error and prevent startup.

In addition to the MCP server, the package includes a standalone OSCAL agent built with Strands Agents. See the OSCAL Agent section below.

What is OSCAL?

OSCAL (Open Security Controls Assessment Language) is a set of framework-agnostic, vendor-neutral, machine-readable schemas developed by NIST that describe the full life cycle of GRC (governance, risk, compliance) artifacts, from controls to remediation plans. OSCAL enables automation of GRC workflows by replacing digital paper (spreadsheets, PDFs, etc.) with a standard-based structured data format. To learn more about OSCAL, install this MCP server then ask your AI. Or see the official OSCAL website.

What is MCP?

MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems. Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect electronic devices, MCP provides a standardized way to connect AI applications to external systems.

How to use / examples

Examples below were created with kiro-cli, but should work with any AI assistant that supports MCP servers.

Example 1: Learn about available OSCAL models

markdown

 % kiro-cli
> /tools trust get_oscal_schema list_oscal_models list_oscal_resources

Tools '@oscal/get_oscal_schema', '@oscal/list_oscal_models', '@oscal/list_oscal_resources' are now trusted. I will not ask for confirmation before running these tools.

> How many GA OSCAL models are there? 

> I'll check the available OSCAL models to find out how many are in GA (Generally Available) status.Running tool list_oscal_models with the param (from mcp server: oscal) ⋮  {} - Completed in 0.1s
> There are 8 GA OSCAL models:
Control Layer (3):- Catalog- Profile  - Mapping Collection
Implementation Layer (2):- Component Definition- System Security Plan (SSP)
Assessment Layer (3):- Assessment Plan (SAP)- Assessment Results (SAR)- Plan of Action and Milestones (POA&M)
All of these models have "GA" (Generally Available) status, meaning they are stable and ready for production use. ▸ Time: 8s

 % kiro-cli
> /tools trust get_oscal_schema list_oscal_models list_oscal_resources

Tools '@oscal/get_oscal_schema', '@oscal/list_oscal_models', '@oscal/list_oscal_resources' are now trusted. I will not ask for confirmation before running these tools.

> How many GA OSCAL models are there? 

> I'll check the available OSCAL models to find out how many are in GA (Generally Available) status.Running tool list_oscal_models with the param (from mcp server: oscal) ⋮  {} - Completed in 0.1s
> There are 8 GA OSCAL models:
Control Layer (3):- Catalog- Profile  - Mapping Collection
Implementation Layer (2):- Component Definition- System Security Plan (SSP)
Assessment Layer (3):- Assessment Plan (SAP)- Assessment Results (SAR)- Plan of Action and Milestones (POA&M)
All of these models have "GA" (Generally Available) status, meaning they are stable and ready for production use. ▸ Time: 8s

Example 2: OSCAL template generation

markdown

> generate a minimum, valid, OSCAL mapping in JSON for use as a template.
> I'll help you create a minimal, valid OSCAL mapping in JSON. Let me first check what OSCAL models are available to understand the structure.Running tool list_oscal_models with the param (from mcp server: oscal) ⋮  {} - Completed in 0.1s
> Now let me get the schema for the mapping-collection model to understand its structure:Running tool get_oscal_schema with the param (from mcp server: oscal) ⋮  { ⋮    "model_name": "mapping-collection", ⋮    "schema_type": "json" ⋮  } - Completed in 0.14s
> Based on the schema, I'll create a minimal, valid OSCAL mapping collection template. Here's the absolute minimum required structure:I'll create the following file: ./oscal-mapping-template.json (using tool: write)Purpose: Create minimal OSCAL mapping collection template
+     1: {+     2:   "mapping-collection": {+     3:     "uuid": "12345678-1234-4567-8901-123456789012",+     4:     "metadata": {+     5:       "title": "Sample Mapping Collection",+     6:       "last-modified": "2026-01-06T20:46:28.034Z",+     7:       "version": "1.0",+     8:       "oscal-version": "1.2.0"+     9:     },+    10:     "provenance": {+    11:       "method": "human",+    12:       "matching-rationale": "semantic",+    13:       "status": "draft",+    14:       "mapping-description": "Sample mapping between two control frameworks"+    15:     },+    16:     "mappings": [+    17:       {+    18:         "uuid": "87654321-4321-7654-1098-210987654321",+    19:         "source-resource": {+    20:           "type": "catalog",+    21:           "href": "https://example.com/source-catalog.json"+    22:         },+    23:         "target-resource": {+    24:           "type": "catalog", +    25:           "href": "https://example.com/target-catalog.json"+    26:         },+    27:         "maps": [+    28:           {+    29:             "uuid": "11111111-2222-3333-4444-555555555555",+    30:             "relationship": "equivalent",+    31:             "sources": [+    32:               {+    33:                 "type": "control",+    34:                 "id-ref": "ac-1"+    35:               }+    36:             ],+    37:             "targets": [+    38:               {+    39:                 "type": "control",+    40:                 "id-ref": "access-control-policy"+    41:               }+    42:             ]+    43:           }+    44:         ]+    45:       }+    46:     ]+    47:   }+    48: }
Creating: ./oscal-mapping-template.json - Completed in 0.8s
> I've created a minimal, valid OSCAL mapping collection template at ./oscal-mapping-template.json. This template includes:
Required elements:- uuid: Unique identifier for the mapping collection- metadata: Document metadata with title, last-modified timestamp, version, and OSCAL version- provenance: Mapping methodology information including method, matching rationale, status, and description- mappings: Array containing at least one mapping with:  - uuid: Mapping identifier  - source-resource and target-resource: References to the catalogs being mapped  - maps: Array with mapping entries showing relationships between controls
Key features:- Uses placeholder UUIDs (replace with actual UUIDs in production)- Maps a source control "ac-1" to target control "access-control-policy" with "equivalent" relationship- Includes minimal required fields only- Valid JSON structure conforming to OSCAL 1.2.0 schema
You can customize this template by:- Replacing placeholder UUIDs with real ones- Updating the resource URLs to point to actual catalogs- Adding more mapping entries in the maps array- Modifying control IDs and relationships as needed ▸ Time: 21s

> generate a minimum, valid, OSCAL mapping in JSON for use as a template.
> I'll help you create a minimal, valid OSCAL mapping in JSON. Let me first check what OSCAL models are available to understand the structure.Running tool list_oscal_models with the param (from mcp server: oscal) ⋮  {} - Completed in 0.1s
> Now let me get the schema for the mapping-collection model to understand its structure:Running tool get_oscal_schema with the param (from mcp server: oscal) ⋮  { ⋮    "model_name": "mapping-collection", ⋮    "schema_type": "json" ⋮  } - Completed in 0.14s
> Based on the schema, I'll create a minimal, valid OSCAL mapping collection template. Here's the absolute minimum required structure:I'll create the following file: ./oscal-mapping-template.json (using tool: write)Purpose: Create minimal OSCAL mapping collection template
+     1: {+     2:   "mapping-collection": {+     3:     "uuid": "12345678-1234-4567-8901-123456789012",+     4:     "metadata": {+     5:       "title": "Sample Mapping Collection",+     6:       "last-modified": "2026-01-06T20:46:28.034Z",+     7:       "version": "1.0",+     8:       "oscal-version": "1.2.0"+     9:     },+    10:     "provenance": {+    11:       "method": "human",+    12:       "matching-rationale": "semantic",+    13:       "status": "draft",+    14:       "mapping-description": "Sample mapping between two control frameworks"+    15:     },+    16:     "mappings": [+    17:       {+    18:         "uuid": "87654321-4321-7654-1098-210987654321",+    19:         "source-resource": {+    20:           "type": "catalog",+    21:           "href": "https://example.com/source-catalog.json"+    22:         },+    23:         "target-resource": {+    24:           "type": "catalog", +    25:           "href": "https://example.com/target-catalog.json"+    26:         },+    27:         "maps": [+    28:           {+    29:             "uuid": "11111111-2222-3333-4444-555555555555",+    30:             "relationship": "equivalent",+    31:             "sources": [+    32:               {+    33:                 "type": "control",+    34:                 "id-ref": "ac-1"+    35:               }+    36:             ],+    37:             "targets": [+    38:               {+    39:                 "type": "control",+    40:                 "id-ref": "access-control-policy"+    41:               }+    42:             ]+    43:           }+    44:         ]+    45:       }+    46:     ]+    47:   }+    48: }
Creating: ./oscal-mapping-template.json - Completed in 0.8s
> I've created a minimal, valid OSCAL mapping collection template at ./oscal-mapping-template.json. This template includes:
Required elements:- uuid: Unique identifier for the mapping collection- metadata: Document metadata with title, last-modified timestamp, version, and OSCAL version- provenance: Mapping methodology information including method, matching rationale, status, and description- mappings: Array containing at least one mapping with:  - uuid: Mapping identifier  - source-resource and target-resource: References to the catalogs being mapped  - maps: Array with mapping entries showing relationships between controls
Key features:- Uses placeholder UUIDs (replace with actual UUIDs in production)- Maps a source control "ac-1" to target control "access-control-policy" with "equivalent" relationship- Includes minimal required fields only- Valid JSON structure conforming to OSCAL 1.2.0 schema
You can customize this template by:- Replacing placeholder UUIDs with real ones- Updating the resource URLs to point to actual catalogs- Adding more mapping entries in the maps array- Modifying control IDs and relationships as needed ▸ Time: 21s

Example 3: Discover open source OSCAL catalogs

markdown

> What are some open source OSCAL catalogs?
Running tool list_oscal_resources with the param (from mcp server: oscal) ⋮  {} - Completed in 0.51s
> Based on the OSCAL community resources, here are some notable open source OSCAL catalogs:
## Government/Official Catalogs
Australian Cyber Security Centre (ACSC)- Information Security Manual (ISM) controls in OSCAL format- Essential Eight Maturity Levels (ML1, ML2, ML3)- Available at: https://www.cyber.gov.au/ism/oscal
CMS Acceptable Risk Safeguards (ARS)- Tailored NIST SP 800-53 controls for Centers for Medicare and Medicaid Services- Available at: https://github.com/CMSgov/ars-machine-readable
GovTech Singapore- ICT&SS Policy catalog and profile for low-risk systems- Available at: https://github.com/GovtechSG/tech-standards
## Industry/Standards Organizations
Center for Internet Security (CIS)- CIS Critical Security Controls (formerly Top 18/20)- Available at: https://github.com/CISecurity/CISControls_OSCAL/
Cloud Security Alliance (CSA)- Cloud Controls Matrix v4 in OSCAL format- Available at: https://cloudsecurityalliance.org/artifacts/ccm-machine-readable-bundle-json-yaml-oscal/
NIST SP 800-171 (Community)- Maintained by Fathom5- Available at: https://github.com/FATHOM5/oscal/tree/main/content/SP800-171/oscal-content
## Community Collections
CivicActions Component Definitions- Cloud services, software, security and privacy controls- Available at: https://github.com/CivicActions/oscal-component-definitions
RedHat OSCAL Content- Component definitions: https://github.com/RedHatProductSecurity/oscal-component-definitions- Custom profiles: https://github.com/RedHatProductSecurity/oscal-profiles
Brad Hards ISM Catalog- Australian Government ISM controls (community version)- Available at: https://github.com/bradh/ism-oscal
These catalogs provide ready-to-use OSCAL content for various compliance frameworks and can serve as templates or starting points for your own OSCAL implementations. ▸ Time: 15s

> What are some open source OSCAL catalogs?
Running tool list_oscal_resources with the param (from mcp server: oscal) ⋮  {} - Completed in 0.51s
> Based on the OSCAL community resources, here are some notable open source OSCAL catalogs:
## Government/Official Catalogs
Australian Cyber Security Centre (ACSC)- Information Security Manual (ISM) controls in OSCAL format- Essential Eight Maturity Levels (ML1, ML2, ML3)- Available at: https://www.cyber.gov.au/ism/oscal
CMS Acceptable Risk Safeguards (ARS)- Tailored NIST SP 800-53 controls for Centers for Medicare and Medicaid Services- Available at: https://github.com/CMSgov/ars-machine-readable
GovTech Singapore- ICT&SS Policy catalog and profile for low-risk systems- Available at: https://github.com/GovtechSG/tech-standards
## Industry/Standards Organizations
Center for Internet Security (CIS)- CIS Critical Security Controls (formerly Top 18/20)- Available at: https://github.com/CISecurity/CISControls_OSCAL/
Cloud Security Alliance (CSA)- Cloud Controls Matrix v4 in OSCAL format- Available at: https://cloudsecurityalliance.org/artifacts/ccm-machine-readable-bundle-json-yaml-oscal/
NIST SP 800-171 (Community)- Maintained by Fathom5- Available at: https://github.com/FATHOM5/oscal/tree/main/content/SP800-171/oscal-content
## Community Collections
CivicActions Component Definitions- Cloud services, software, security and privacy controls- Available at: https://github.com/CivicActions/oscal-component-definitions
RedHat OSCAL Content- Component definitions: https://github.com/RedHatProductSecurity/oscal-component-definitions- Custom profiles: https://github.com/RedHatProductSecurity/oscal-profiles
Brad Hards ISM Catalog- Australian Government ISM controls (community version)- Available at: https://github.com/bradh/ism-oscal
These catalogs provide ready-to-use OSCAL content for various compliance frameworks and can serve as templates or starting points for your own OSCAL implementations. ▸ Time: 15s

Example 4: Query component definitions for information about AWS services

markdown

[OSCAL] > what components are available for Cognito?
Running tool list_components with the param (from mcp server: oscal-dev) ⋮  {} - Completed in 0.49s
> There are 3 Cognito-related components available:
1. Cognito Identity - from "Cognito Identity Pools" component definition2. Cognito Sync - from "Amazon Cognito Sync" component definition  3. Cognito Identity Provider - from "Amazon Cognito Identity User Pools" component definition
 ▸ Time: 7s
[OSCAL] > show me the names and IDs from all 3 components
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "7fd5d354-6ec4-4f8e-8c5f-2904086bb597" ⋮  }Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "a1d82e1d-3733-41f4-bc09-90ab47b9e82f" ⋮  }Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "2519deaf-4612-4c70-aba2-d9080ae3c816" ⋮  } - Completed in 0.13s
 - Completed in 0.6s
 - Completed in 0.6s
> 1. Cognito Sync- Service ID: Cognito Sync- API Endpoint Prefix: cognito-sync- ARN Namespace: cognito-sync
2. Cognito Identity Provider- Service ID: Cognito Identity Provider- API Endpoint Prefix: cognito-idp- ARN Namespace: cognito-idp
3. Cognito Identity- Service ID: Cognito Identity- API Endpoint Prefix: cognito-identity- ARN Namespace: cognito-identity
 ▸ Time: 12s
[OSCAL] > show me everything in the EC2 component definition
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "component_definition_filter": "Elastic Compute Cloud (EC2)", ⋮    "query_type": "all" ⋮  } - Completed in 0.14s
> The EC2 component definition contains 1 component:
Component: EC2- UUID: 66345eb9-7c0d-435c-b2b5-675fd977de80- Type: service- Description: Empty
Properties:- Service ID: EC2- Version: 2016-11-15- Availability: REGIONAL and ZONAL- Full Name: Elastic Compute Cloud (EC2)- API Endpoint Prefix: ec2- ARN Namespace: ec2
Regional Availability (34 regions):Africa (Cape Town), Asia Pacific (Hong Kong, Tokyo, Seoul, Osaka, Mumbai, Hyderabad, Singapore, Sydney, Jakarta, Melbourne, Malaysia), Canada (Central, Calgary), China (Beijing, Ningxia), Europe (Frankfurt, Zurich, Stockholm, Milan, Spain, Ireland, London, Paris), Israel (Tel Aviv), Middle East (UAE, Bahrain), South America (Sao Paulo), US East (N. Virginia, Ohio), AWS GovCloud (US-East, US-West), US West (N. California, Oregon)
 ▸ Time: 10s
[OSCAL] > what's the ID of the Jakarta region?
> Based on the EC2 component data I just retrieved, the Jakarta region's resource fragment ID is:
8041109b-0a0b-46cc-bddb-91d703667637
This is the UUID for the "Asia Pacific (Jakarta)" region component.
 ▸ Time: 3s
[OSCAL] > get the region ID from that component
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "8041109b-0a0b-46cc-bddb-91d703667637" ⋮  } - Completed in 0.13s
> The region ID for Jakarta is: ap-southeast-3
 ▸ Time: 7s
[OSCAL] > /quit

[OSCAL] > what components are available for Cognito?
Running tool list_components with the param (from mcp server: oscal-dev) ⋮  {} - Completed in 0.49s
> There are 3 Cognito-related components available:
1. Cognito Identity - from "Cognito Identity Pools" component definition2. Cognito Sync - from "Amazon Cognito Sync" component definition  3. Cognito Identity Provider - from "Amazon Cognito Identity User Pools" component definition
 ▸ Time: 7s
[OSCAL] > show me the names and IDs from all 3 components
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "7fd5d354-6ec4-4f8e-8c5f-2904086bb597" ⋮  }Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "a1d82e1d-3733-41f4-bc09-90ab47b9e82f" ⋮  }Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "2519deaf-4612-4c70-aba2-d9080ae3c816" ⋮  } - Completed in 0.13s
 - Completed in 0.6s
 - Completed in 0.6s
> 1. Cognito Sync- Service ID: Cognito Sync- API Endpoint Prefix: cognito-sync- ARN Namespace: cognito-sync
2. Cognito Identity Provider- Service ID: Cognito Identity Provider- API Endpoint Prefix: cognito-idp- ARN Namespace: cognito-idp
3. Cognito Identity- Service ID: Cognito Identity- API Endpoint Prefix: cognito-identity- ARN Namespace: cognito-identity
 ▸ Time: 12s
[OSCAL] > show me everything in the EC2 component definition
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "component_definition_filter": "Elastic Compute Cloud (EC2)", ⋮    "query_type": "all" ⋮  } - Completed in 0.14s
> The EC2 component definition contains 1 component:
Component: EC2- UUID: 66345eb9-7c0d-435c-b2b5-675fd977de80- Type: service- Description: Empty
Properties:- Service ID: EC2- Version: 2016-11-15- Availability: REGIONAL and ZONAL- Full Name: Elastic Compute Cloud (EC2)- API Endpoint Prefix: ec2- ARN Namespace: ec2
Regional Availability (34 regions):Africa (Cape Town), Asia Pacific (Hong Kong, Tokyo, Seoul, Osaka, Mumbai, Hyderabad, Singapore, Sydney, Jakarta, Melbourne, Malaysia), Canada (Central, Calgary), China (Beijing, Ningxia), Europe (Frankfurt, Zurich, Stockholm, Milan, Spain, Ireland, London, Paris), Israel (Tel Aviv), Middle East (UAE, Bahrain), South America (Sao Paulo), US East (N. Virginia, Ohio), AWS GovCloud (US-East, US-West), US West (N. California, Oregon)
 ▸ Time: 10s
[OSCAL] > what's the ID of the Jakarta region?
> Based on the EC2 component data I just retrieved, the Jakarta region's resource fragment ID is:
8041109b-0a0b-46cc-bddb-91d703667637
This is the UUID for the "Asia Pacific (Jakarta)" region component.
 ▸ Time: 3s
[OSCAL] > get the region ID from that component
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "8041109b-0a0b-46cc-bddb-91d703667637" ⋮  } - Completed in 0.13s
> The region ID for Jakarta is: ap-southeast-3
 ▸ Time: 7s
[OSCAL] > /quit

Installation

Follow these instructions to setup the MCP server for use with your preferred IDE, AI agent, chatbot, etc. The server is published as Python package on PyPI. The uvx command (shown below) automatically downloads the latest version of the server from PyPI on startup.

[!NOTE] To setup for development instead, see DEVELOPING.md

Prerequisites

uv package manager for Python (Installation instructions)
Python 3.11 or higher (uv install python 3.12). The server may work with later versions of Python, but we only test 3.11 & 3.12 for now.

Configuring IDEs and AI Tools

This server communicates via stdio (standard input/output) and can be integrated with various IDEs and agentic tools that support the Model Context Protocol. The configuration examples shown below are for your preferred IDE / chatbot / agent.

Configuration Format

Most MCP-compatible tools use a JSON configuration format described in the FastMCP documentation. Here's the basic structure:

json

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"]    }  }}

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"]    }  }}

For typical, runtime use of the MCP server, additional configuration should not be required. If needed, runtime environment variables can be configured in an "env": {} object as described in the FastMCP documentation. See the file dotenv.example for available options.

[!Note] A dotenv file is only needed in a development environment.

Kiro Configuration

See Kiro's MCP documentation for additional options. Add to your .kiro/settings/mcp.json:

json

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"],      "env": {},      "disabled": false,      "autoApprove": [        "*"      ]    }  }}

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"],      "env": {},      "disabled": false,      "autoApprove": [        "*"      ]    }  }}

Claude Desktop

Add to your ~/.claude/claude_desktop_config.json:

json

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"]    }  }}

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"]    }  }}

VS Code

Run the MCP: Open User Configuration command, which opens the mcp.json file in your user profile. You can then manually add the server configuration to the file. See the VSCode/Copilot docs for additional options and details.

json

{  "servers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"]    }  }}

{  "servers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"]    }  }}

Using your own OSCAL Content

By default, the server ships with bundled OSCAL content (AWS component definitions, OSCAL documentation, and schemas). You can also point the server at a directory of your own OSCAL JSON files — catalogs, SSPs, profiles, assessment plans, assessment results, POA&Ms, or mapping collections. The server indexes them at startup and makes them available through all query and list tools.

Set the OSCAL_DOCUMENTS_DIR environment variable to the path of your OSCAL content directory. The path can be absolute or relative to the server's package directory. For example, in your MCP configuration:

json

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"],      "env": {        "OSCAL_DOCUMENTS_DIR": "/path/to/your/oscal/files"      }    }  }}

{  "mcpServers": {    "oscal": {      "command": "uvx",      "args": ["mcp-server-for-oscal@latest"],      "env": {        "OSCAL_DOCUMENTS_DIR": "/path/to/your/oscal/files"      }    }  }}

The server scans the directory recursively for .json files and indexes any valid OSCAL documents it finds. Your content is merged with the bundled content — both are queryable in the same session.

Two additional environment variables control the OSCAL store behavior:

Variable	Default	Description
`OSCAL_DOCUMENTS_DIR`	(empty)	Directory containing your OSCAL JSON files. Not scanned when empty.
`OSCAL_STORE_DB_PATH`	(empty)	Path to a persistent SQLite database. When set, the index is reused across server restarts instead of being rebuilt each time.
`OSCAL_STORE_CACHE_SIZE`	`100`	Maximum number of parsed OSCAL documents to keep in the in-memory LRU cache.

[!TIP] Setting OSCAL_STORE_DB_PATH is recommended if you have a large collection of OSCAL documents. The server only needs to index new or changed files on subsequent startups.

OSCAL Agent

In addition to the MCP server, the package includes a standalone OSCAL agent built with Strands Agents. The agent uses the same tools as the MCP server and can be run directly:

The agent requires AWS Bedrock access and uses the same configuration environment variables as the MCP server.

Session Persistence

The agent supports session persistence so that conversation history and agent state survive across invocations. Choose between local filesystem or Amazon S3 storage:

bash

# File-based session storage (new session)oscal-agent --session-storage file
# Resume a previous sessionoscal-agent --session-storage file --session-id <your-session-id>
# S3-based session storageoscal-agent --session-storage s3 --session-s3-bucket my-bucket

# File-based session storage (new session)oscal-agent --session-storage file
# Resume a previous sessionoscal-agent --session-storage file --session-id <your-session-id>
# S3-based session storageoscal-agent --session-storage s3 --session-s3-bucket my-bucket

When session storage is enabled without a --session-id, a UUID is auto-generated and displayed so you can resume later. Session defaults can also be set via environment variables (see DEVELOPING.md).

Conversation Management

For long-running workflows, you can select a conversation manager to control how the agent's context window is maintained:

bash

# Summarize older messages to keep context manageableoscal-agent --session-storage file --conversation-manager summarizing
# Sliding window (SDK default behavior)oscal-agent --conversation-manager sliding-window
# No conversation managementoscal-agent --conversation-manager null

# Summarize older messages to keep context manageableoscal-agent --session-storage file --conversation-manager summarizing
# Sliding window (SDK default behavior)oscal-agent --conversation-manager sliding-window
# No conversation managementoscal-agent --conversation-manager null

Existing tools and features cover a variety of use-cases but are far from comprehensive. Please share your feedback, feature requests, questions, or bug reports in a GitHub issue. Direct contributions are wanted and welcome.

Development

See DEVELOPING to get started.

Security

See CONTRIBUTING for more information.

Known limitations

It's not yet possible to use this MCP server with ChatGPT due to limited MCP support by ChatGPT.
The streamable-http transport does not yet implement authentication or transport security. Use stdio for production workloads.

Related projects

Experimental Component Definitions for AWS services are bundled with this MCP server. You can find that content in the AWS Labs project OSCAL Content for AWS Services.

MCP Server for OSCAL uses compliance-trestle for certain capabilities, including OSCAL content validation.

License

This project is licensed under the Apache-2.0 License.

来源：README.md，提交 de7f356

工具

SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

v0.4.0最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

近 30 天内可连通25 分
请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。
已声明认证方式10 分
请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。
已列出工具15 分
请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。
描述必需15 分
图标10 分
文档15 分
许可证10 分