Coso Mcp

io.github.simonmak-ascent由 GitHub 账号 simonmak-ascent 发布v0.1.1更新于 Oct 24, 2026

Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.

发布方自己的服务：Coso Mcp

已验证Streamable HTTP可网页运行数据与分析商业与电商

概览

AI 生成的概览

一个开放的内控审查 MCP 服务器，按 COSO 框架支持从范围界定、风险评估到抽样、测试、工作底稿和缺陷报告的完整流程。

可以做什么
查询 COSO 框架资料：五要素、17 项原则、目标类别与认定，并提供原则/要素覆盖指标和五要素整合检查。创建和管理审查项目、范围事项、风险与控制，并查看每个项目的追加式审计日志。登记总体、计算建议样本量，并进行带随机种子的可复现抽样。记录测试结果与例外，汇编 Markdown 工作底稿，添加和解决复核意见，并以编制人或复核人身份签署。对缺陷进行分类与汇总，并生成 Markdown 审查报告。
适用场景
适合在助手协助规划或记录基于 COSO ICIF-2013 的内部控制或 ICFR 审查时使用，需要结构化、可追溯的产出而非自由文本。也适合在界定范围前了解框架的要素与原则。
运行要求
可通过 npm 包以 npx 在本地以 stdio 运行，需要 Node.js；也可连接托管的 streamable HTTP 端点。托管端点开放、无需账号，未声明任何环境变量或请求头。
安装前请注意
服务器声明其内容不构成审计或法律意见，工作底稿与评估须经合格专业人员复核后方可用于审计文档。写入类工具会创建项目、风险、控制、样本、测试结果和签署；在托管端点上这些操作运行于临时、限流的按会话沙箱中且不会持久保存，会话间工作会丢失。签署时会提示同一人兼任编制与复核的独立性问题。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Coso Mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.simonmak-ascent%2Fcoso-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "coso": {
      "type": "http",
      "url": "https://internal-control.ascent-partners.com/mcp"
    }
  }
}

README

coso-mcp

[npm] [license: MIT] [MCP]

An open Model Context Protocol server for internal-control reviews under the COSO Internal Control—Integrated Framework (ICIF-2013). It covers the full review lifecycle — scope → risk assessment → control register → population → sampling → testing → workpapers → review sign-off → deficiency evaluation → report — grounded in the framework's 5 components, 17 principles and points of focus.

  • Local: runs over stdio (npx @simonmak-ascent/coso-mcp).
  • Hosted: public endpoint at https://internal-control.ascent-partners.com/mcp (reference + read tools, plus an ephemeral per-session sandbox for the full write lifecycle — nothing persists).

Not audit or legal advice. This server assists with internal-control review methodology. All workpapers and assessments must be reviewed by qualified professionals before use in audit documentation.

Why this exists (competitive advantage)

Existing MCP servers either expose a vendor's GRC records (read-mostly, proprietary, product-shaped) or cover ISO 27001 / security controls. None runs a traceable COSO review. coso-mcp is the first COSO/ICFR-native, write-capable, open MCP for the whole lifecycle.

Dimensioncoso-mcpVendor GRC MCPs (Workiva, Vanta, Drata, Optro, OpenPages, LogicGate…)Community MCPs (iso27001-mcp, unidoc/isms, mcp-server-scf…)AI skills (sox-testing / audit-support)
COSO ICIF-2013 native (5 components / 17 principles / points of focus)✅ core engine❌ product objects❌ ISO/SCF-shaped⚠️ text only
Full lifecycle to signed workpaper✅❌ retrieval; Workiva GRC tools are read-only❌ planning/findings at best⚠️ templates, not executable
Write/stateful workpapers + preparer/reviewer sign-off + audit trail✅❌ mostly read❌❌
Framework effectiveness (principle/component present & functioning)✅❌❌❌
Deterministic, reproducible computation (sample-size tables, seeded selection)✅partial❌❌ (freeform)
Open source + open access (MIT, public endpoint, no account)✅❌ paid platform⚠️ some OSS⚠️ not a server

Moat: it is the lifecycle layer, not the data layer — it can sit on top of Workiva/Vanta/Drata rather than compete for their data; its sampling and deficiency math are computed, not improvised; and openness gives zero-friction distribution no gated vendor can match.

Tools

ToolKindPurpose
get_server_inforeadServer identity, framework coverage, disclaimer.
list_componentsreadThe five COSO components.
list_principlesreadThe 17 principles (optionally filtered by component).
get_principlereadA principle by number or slug, with paraphrased points of focus.
get_componentreadA component by id, with its principles.
list_objective_categoriesreadOperations / reporting / compliance.
list_assertionsreadThe CEAVOP assertions used to frame control objectives.
create_engagementwriteCreate a review engagement.
get_engagementreadGet an engagement by id.
list_engagementsreadList engagements.
add_scope_itemwriteAdd a significant account/process to scope.
list_scope_itemsreadList scope items.
register_riskwriteRegister a risk to objectives (likelihood, assertions, principles, fraud).
list_risksreadList registered risks.
register_controlwriteRegister a control (type, frequency, linked risks, assertions).
list_controlsreadList registered controls.
get_audit_logreadAppend-only audit events for an engagement.
compute_sample_sizereadRecommended sample size from frequency × risk, with rationale.
create_populationwriteRegister a population (item list or declared size, bounded).
list_populationsreadList populations.
select_samplewriteSeeded, reproducible sample selection (random/systematic/targeted/haphazard).
record_test_resultwriteRecord attribute-level outcomes (pass/fail/na) and a conclusion.
list_test_resultsreadList test results.
note_exceptionwriteRecord an exception with root cause and impact.
list_exceptionsreadList exceptions.
assemble_workpaperwriteAssemble a Markdown control-testing workpaper.
list_workpapersreadList workpapers.
get_workpaperreadGet a workpaper with its Markdown.
add_review_notewriteAdd a reviewer note.
resolve_review_notewriteResolve a reviewer note.
sign_offwritePreparer/reviewer sign-off (warns on same-person independence).
get_activity_logreadAppend-only activity log for an engagement.
classify_deficiencywriteClassify a deficiency (deficiency / significant / material weakness).
list_deficienciesreadList deficiencies.
aggregate_deficienciesreadGroup and flag deficiencies that may aggregate.
assess_principlereadCoverage indicators for one COSO principle.
assess_componentreadCoverage indicators for one COSO component.
framework_integration_checkreadCheck all five components have coverage.
generate_reportreadGenerate the Markdown review report.

Resources: coso://framework/icif-2013 (framework reference), coso://engagement/{id} (engagement bundle: scope, risks, controls). Prompts: scope-review, assess-risk, build-control-matrix, draft-test-workpaper, evaluate-deficiencies.

Usage

Local (stdio)

bash
npx -y @simonmak-ascent/coso-mcp

Claude Desktop / generic MCP client config:

json
{  "mcpServers": {    "coso": {      "command": "npx",      "args": ["-y", "@simonmak-ascent/coso-mcp"]    }  }}

Hosted (streamable HTTP)

https://internal-control.ascent-partners.com/mcp

The hosted endpoint is open. Write operations run in an ephemeral, isolated, rate-limited per-session sandbox and are not persisted.

Development

Compute runs on a box, never locally: cs run "<cmd>".

bash
pnpm installpnpm typecheckpnpm testpnpm test:coveragepnpm build        # tsc

Security

See SECURITY.md. Report vulnerabilities privately — do not open a public issue.

Contributing

See CONTRIBUTING.md and the Code of Conduct.

License

MIT © Simon Mak / Ascent Partners Group Limited.

来源：README.md，提交 21c780e

工具

0
SourceWeft 尚未读取此服务器的工具。

版本历史

1
  1. v0.1.1最新Oct 12, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式必需10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Ascent-Partners 集成

Coso Mcp

com.ascent-partners官方发布者

一个开放的内控审查 MCP 服务器，按 COSO 框架支持从范围界定、风险评估到抽样、测试、工作底稿和缺陷报告的完整流程。

Streamable HTTP可网页运行
数据与分析尚未收录Oct 25, 2026

Startup Valuation MCP Server

com.ascent-partners官方发布者

计算创业公司估值：14 个工具覆盖 80 多个早期、行业与股权公式，可本地运行或使用托管端点。

Streamable HTTP可网页运行
金融14 个工具Nov 4, 2026

Intangible Asset Valuation MCP Server

com.ascent-partners官方发布者

通过 14 个工具、124+ 条教材公式计算无形资产估值，涵盖知识产权、技术、商誉、PPA 与减值。

Streamable HTTP可网页运行
金融14 个工具Oct 24, 2026

HKEx Filings

com.ascent-partners官方发布者

以只读方式访问港交所实时披露文件：按日期窗口检索、浏览分类统计，并下载文件提取正文与表格。

Streamable HTTP可网页运行
网页搜索与抓取4 个工具Nov 4, 2026

Fair Value MCP Server

com.ascent-partners官方发布者

金融估值 MCP 服务器，提供 14 个 calculate_* 工具，涵盖 DCF、WACC、期权、信用风险、精算与结构性产品，并附 IFRS/IVS 条款引用。

Streamable HTTP可网页运行
金融14 个工具Oct 24, 2026