Coso Mcp

com.ascent-partners由 ascent-partners.com 發布官方發布者v0.1.2更新於 Oct 25, 2026

Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.

已驗證Streamable HTTP可網頁執行資料與分析商業與電商

概覽

AI 產生的概覽

一個開放的內控審查 MCP 伺服器，依 COSO 架構支援從範圍界定、風險評估到抽樣、測試、工作底稿與缺失報告的完整流程。

可以做什麼
查詢 COSO 架構參考資料：五要素、17 項原則、目標類別與聲明，以及依原則和要素的覆蓋指標與架構整合檢查。建立並管理審查專案、範圍項目、風險與控制的登錄，並檢視每個專案的僅附加稽核日誌。計算樣本量、登錄母體、進行可重現的抽樣，並記錄測試結果與例外事項。彙編 Markdown 控制測試工作底稿，新增與解決複核意見，並記錄編製人/複核人簽署。對缺失進行分類與彙總，並產生 Markdown 審查報告。
適用情境
適合助理協助規劃或記錄依 COSO ICIF-2013 的內部控制或 ICFR 審查，且需要結構化、可追溯紀錄而非自由文字時使用。託管端點方便免設定體驗完整流程，本機套件則適合在用戶端長期使用。
執行需求
可使用託管的 streamable HTTP 端點，或以 npx 透過 stdio 執行 npm 套件 @simonmak-ascent/coso-mcp 的本機程序，後者需要 Node.js。未宣告需要帳號、API 金鑰、環境變數或標頭。使用託管端點需要網路存取。
安裝前請注意
README 聲明本伺服器不構成審計或法律意見，工作底稿與評估須經合格專業人員複核後方可用於審計文件。寫入類工具會建立專案、風險、控制、樣本、測試結果、簽署與缺失；在託管端點上這些操作於依工作階段隔離的臨時沙箱中執行且不會持久化，工作階段結束後不保留。簽署時會提示同一人簽署的獨立性風險。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Coso Mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.ascent-partners%2Fcoso-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "coso": {
      "type": "http",
      "url": "https://internal-control.ascent-partners.com/mcp"
    }
  }
}

README

coso-mcp

[npm] [license: MIT] [MCP]

An open Model Context Protocol server for internal-control reviews under the COSO Internal Control—Integrated Framework (ICIF-2013). It covers the full review lifecycle — scope → risk assessment → control register → population → sampling → testing → workpapers → review sign-off → deficiency evaluation → report — grounded in the framework's 5 components, 17 principles and points of focus.

  • Local: runs over stdio (npx @simonmak-ascent/coso-mcp).
  • Hosted: public endpoint at https://internal-control.ascent-partners.com/mcp (reference + read tools, plus an ephemeral per-session sandbox for the full write lifecycle — nothing persists).

Not audit or legal advice. This server assists with internal-control review methodology. All workpapers and assessments must be reviewed by qualified professionals before use in audit documentation.

Why this exists (competitive advantage)

Existing MCP servers either expose a vendor's GRC records (read-mostly, proprietary, product-shaped) or cover ISO 27001 / security controls. None runs a traceable COSO review. coso-mcp is the first COSO/ICFR-native, write-capable, open MCP for the whole lifecycle.

Dimensioncoso-mcpVendor GRC MCPs (Workiva, Vanta, Drata, Optro, OpenPages, LogicGate…)Community MCPs (iso27001-mcp, unidoc/isms, mcp-server-scf…)AI skills (sox-testing / audit-support)
COSO ICIF-2013 native (5 components / 17 principles / points of focus)✅ core engine❌ product objects❌ ISO/SCF-shaped⚠️ text only
Full lifecycle to signed workpaper✅❌ retrieval; Workiva GRC tools are read-only❌ planning/findings at best⚠️ templates, not executable
Write/stateful workpapers + preparer/reviewer sign-off + audit trail✅❌ mostly read❌❌
Framework effectiveness (principle/component present & functioning)✅❌❌❌
Deterministic, reproducible computation (sample-size tables, seeded selection)✅partial❌❌ (freeform)
Open source + open access (MIT, public endpoint, no account)✅❌ paid platform⚠️ some OSS⚠️ not a server

Moat: it is the lifecycle layer, not the data layer — it can sit on top of Workiva/Vanta/Drata rather than compete for their data; its sampling and deficiency math are computed, not improvised; and openness gives zero-friction distribution no gated vendor can match.

Tools

ToolKindPurpose
get_server_inforeadServer identity, framework coverage, disclaimer.
list_componentsreadThe five COSO components.
list_principlesreadThe 17 principles (optionally filtered by component).
get_principlereadA principle by number or slug, with paraphrased points of focus.
get_componentreadA component by id, with its principles.
list_objective_categoriesreadOperations / reporting / compliance.
list_assertionsreadThe CEAVOP assertions used to frame control objectives.
create_engagementwriteCreate a review engagement.
get_engagementreadGet an engagement by id.
list_engagementsreadList engagements.
add_scope_itemwriteAdd a significant account/process to scope.
list_scope_itemsreadList scope items.
register_riskwriteRegister a risk to objectives (likelihood, assertions, principles, fraud).
list_risksreadList registered risks.
register_controlwriteRegister a control (type, frequency, linked risks, assertions).
list_controlsreadList registered controls.
get_audit_logreadAppend-only audit events for an engagement.
compute_sample_sizereadRecommended sample size from frequency × risk, with rationale.
create_populationwriteRegister a population (item list or declared size, bounded).
list_populationsreadList populations.
select_samplewriteSeeded, reproducible sample selection (random/systematic/targeted/haphazard).
record_test_resultwriteRecord attribute-level outcomes (pass/fail/na) and a conclusion.
list_test_resultsreadList test results.
note_exceptionwriteRecord an exception with root cause and impact.
list_exceptionsreadList exceptions.
assemble_workpaperwriteAssemble a Markdown control-testing workpaper.
list_workpapersreadList workpapers.
get_workpaperreadGet a workpaper with its Markdown.
add_review_notewriteAdd a reviewer note.
resolve_review_notewriteResolve a reviewer note.
sign_offwritePreparer/reviewer sign-off (warns on same-person independence).
get_activity_logreadAppend-only activity log for an engagement.
classify_deficiencywriteClassify a deficiency (deficiency / significant / material weakness).
list_deficienciesreadList deficiencies.
aggregate_deficienciesreadGroup and flag deficiencies that may aggregate.
assess_principlereadCoverage indicators for one COSO principle.
assess_componentreadCoverage indicators for one COSO component.
framework_integration_checkreadCheck all five components have coverage.
generate_reportreadGenerate the Markdown review report.

Resources: coso://framework/icif-2013 (framework reference), coso://engagement/{id} (engagement bundle: scope, risks, controls). Prompts: scope-review, assess-risk, build-control-matrix, draft-test-workpaper, evaluate-deficiencies.

Usage

Local (stdio)

bash
npx -y @simonmak-ascent/coso-mcp

Claude Desktop / generic MCP client config:

json
{  "mcpServers": {    "coso": {      "command": "npx",      "args": ["-y", "@simonmak-ascent/coso-mcp"]    }  }}

Hosted (streamable HTTP)

https://internal-control.ascent-partners.com/mcp

The hosted endpoint is open. Write operations run in an ephemeral, isolated, rate-limited per-session sandbox and are not persisted.

Development

Compute runs on a box, never locally: cs run "<cmd>".

bash
pnpm installpnpm typecheckpnpm testpnpm test:coveragepnpm build        # tsc

Security

See SECURITY.md. Report vulnerabilities privately — do not open a public issue.

Contributing

See CONTRIBUTING.md and the Code of Conduct.

License

MIT © Simon Mak / Ascent Partners Group Limited.

來源：README.md，提交 7a147fc

工具

0
SourceWeft 尚未讀取此伺服器的工具。

版本歷史

1
  1. v0.1.2最新Oct 14, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Ascent-Partners 整合

Startup Valuation MCP Server

com.ascent-partners官方發布者

計算新創公司估值：14 個工具涵蓋 80 多個早期、產業與股權公式，可本機執行或使用託管端點。

Streamable HTTP可網頁執行
金融14 個工具Nov 4, 2026

Intangible Asset Valuation MCP Server

com.ascent-partners官方發布者

透過 14 個工具、124+ 條教材公式計算無形資產評價，涵蓋智慧財產、技術、商譽、PPA 與減損。

Streamable HTTP可網頁執行
金融14 個工具Oct 24, 2026

HKEx Filings

com.ascent-partners官方發布者

以唯讀方式存取港交所即時申報文件：依日期區間搜尋、瀏覽分類統計，並下載文件擷取內文與表格。

Streamable HTTP可網頁執行
網頁搜尋與抓取4 個工具Nov 4, 2026

Fair Value MCP Server

com.ascent-partners官方發布者

金融估值 MCP 伺服器，提供 14 個 calculate_* 工具，涵蓋 DCF、WACC、選擇權、信用風險、精算與結構型商品，並附 IFRS/IVS 條款引用。

Streamable HTTP可網頁執行
金融14 個工具Oct 24, 2026

Vision Driven Design (VDD) MCP Server

com.ascent-partners

一套規格驅動開發的 MCP 伺服器，引導助理完成從專案章程到可驗證、可追溯的規格與任務的八個階段。

Streamable HTTP可網頁執行
效率與工作流15 個工具Oct 24, 2026