MCP Server for OSCAL

 % kiro-cli
> /tools trust get_oscal_schema list_oscal_models list_oscal_resources

Tools '@oscal/get_oscal_schema', '@oscal/list_oscal_models', '@oscal/list_oscal_resources' are now trusted. I will not ask for confirmation before running these tools.

> How many GA OSCAL models are there? 

> I'll check the available OSCAL models to find out how many are in GA (Generally Available) status.Running tool list_oscal_models with the param (from mcp server: oscal) ⋮  {} - Completed in 0.1s
> There are 8 GA OSCAL models:
Control Layer (3):- Catalog- Profile  - Mapping Collection
Implementation Layer (2):- Component Definition- System Security Plan (SSP)
Assessment Layer (3):- Assessment Plan (SAP)- Assessment Results (SAR)- Plan of Action and Milestones (POA&M)
All of these models have "GA" (Generally Available) status, meaning they are stable and ready for production use. ▸ Time: 8s

> generate a minimum, valid, OSCAL mapping in JSON for use as a template.
> I'll help you create a minimal, valid OSCAL mapping in JSON. Let me first check what OSCAL models are available to understand the structure.Running tool list_oscal_models with the param (from mcp server: oscal) ⋮  {} - Completed in 0.1s
> Now let me get the schema for the mapping-collection model to understand its structure:Running tool get_oscal_schema with the param (from mcp server: oscal) ⋮  { ⋮    "model_name": "mapping-collection", ⋮    "schema_type": "json" ⋮  } - Completed in 0.14s
> Based on the schema, I'll create a minimal, valid OSCAL mapping collection template. Here's the absolute minimum required structure:I'll create the following file: ./oscal-mapping-template.json (using tool: write)Purpose: Create minimal OSCAL mapping collection template
+     1: {+     2:   "mapping-collection": {+     3:     "uuid": "12345678-1234-4567-8901-123456789012",+     4:     "metadata": {+     5:       "title": "Sample Mapping Collection",+     6:       "last-modified": "2026-01-06T20:46:28.034Z",+     7:       "version": "1.0",+     8:       "oscal-version": "1.2.0"+     9:     },+    10:     "provenance": {+    11:       "method": "human",+    12:       "matching-rationale": "semantic",+    13:       "status": "draft",+    14:       "mapping-description": "Sample mapping between two control frameworks"+    15:     },+    16:     "mappings": [+    17:       {+    18:         "uuid": "87654321-4321-7654-1098-210987654321",+    19:         "source-resource": {+    20:           "type": "catalog",+    21:           "href": "https://example.com/source-catalog.json"+    22:         },+    23:         "target-resource": {+    24:           "type": "catalog", +    25:           "href": "https://example.com/target-catalog.json"+    26:         },+    27:         "maps": [+    28:           {+    29:             "uuid": "11111111-2222-3333-4444-555555555555",+    30:             "relationship": "equivalent",+    31:             "sources": [+    32:               {+    33:                 "type": "control",+    34:                 "id-ref": "ac-1"+    35:               }+    36:             ],+    37:             "targets": [+    38:               {+    39:                 "type": "control",+    40:                 "id-ref": "access-control-policy"+    41:               }+    42:             ]+    43:           }+    44:         ]+    45:       }+    46:     ]+    47:   }+    48: }
Creating: ./oscal-mapping-template.json - Completed in 0.8s
> I've created a minimal, valid OSCAL mapping collection template at ./oscal-mapping-template.json. This template includes:
Required elements:- uuid: Unique identifier for the mapping collection- metadata: Document metadata with title, last-modified timestamp, version, and OSCAL version- provenance: Mapping methodology information including method, matching rationale, status, and description- mappings: Array containing at least one mapping with:  - uuid: Mapping identifier  - source-resource and target-resource: References to the catalogs being mapped  - maps: Array with mapping entries showing relationships between controls
Key features:- Uses placeholder UUIDs (replace with actual UUIDs in production)- Maps a source control "ac-1" to target control "access-control-policy" with "equivalent" relationship- Includes minimal required fields only- Valid JSON structure conforming to OSCAL 1.2.0 schema
You can customize this template by:- Replacing placeholder UUIDs with real ones- Updating the resource URLs to point to actual catalogs- Adding more mapping entries in the maps array- Modifying control IDs and relationships as needed ▸ Time: 21s

> What are some open source OSCAL catalogs?
Running tool list_oscal_resources with the param (from mcp server: oscal) ⋮  {} - Completed in 0.51s
> Based on the OSCAL community resources, here are some notable open source OSCAL catalogs:
## Government/Official Catalogs
Australian Cyber Security Centre (ACSC)- Information Security Manual (ISM) controls in OSCAL format- Essential Eight Maturity Levels (ML1, ML2, ML3)- Available at: https://www.cyber.gov.au/ism/oscal
CMS Acceptable Risk Safeguards (ARS)- Tailored NIST SP 800-53 controls for Centers for Medicare and Medicaid Services- Available at: https://github.com/CMSgov/ars-machine-readable
GovTech Singapore- ICT&SS Policy catalog and profile for low-risk systems- Available at: https://github.com/GovtechSG/tech-standards
## Industry/Standards Organizations
Center for Internet Security (CIS)- CIS Critical Security Controls (formerly Top 18/20)- Available at: https://github.com/CISecurity/CISControls_OSCAL/
Cloud Security Alliance (CSA)- Cloud Controls Matrix v4 in OSCAL format- Available at: https://cloudsecurityalliance.org/artifacts/ccm-machine-readable-bundle-json-yaml-oscal/
NIST SP 800-171 (Community)- Maintained by Fathom5- Available at: https://github.com/FATHOM5/oscal/tree/main/content/SP800-171/oscal-content
## Community Collections
CivicActions Component Definitions- Cloud services, software, security and privacy controls- Available at: https://github.com/CivicActions/oscal-component-definitions
RedHat OSCAL Content- Component definitions: https://github.com/RedHatProductSecurity/oscal-component-definitions- Custom profiles: https://github.com/RedHatProductSecurity/oscal-profiles
Brad Hards ISM Catalog- Australian Government ISM controls (community version)- Available at: https://github.com/bradh/ism-oscal
These catalogs provide ready-to-use OSCAL content for various compliance frameworks and can serve as templates or starting points for your own OSCAL implementations. ▸ Time: 15s

[OSCAL] > what components are available for Cognito?
Running tool list_components with the param (from mcp server: oscal-dev) ⋮  {} - Completed in 0.49s
> There are 3 Cognito-related components available:
1. Cognito Identity - from "Cognito Identity Pools" component definition2. Cognito Sync - from "Amazon Cognito Sync" component definition  3. Cognito Identity Provider - from "Amazon Cognito Identity User Pools" component definition
 ▸ Time: 7s
[OSCAL] > show me the names and IDs from all 3 components
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "7fd5d354-6ec4-4f8e-8c5f-2904086bb597" ⋮  }Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "a1d82e1d-3733-41f4-bc09-90ab47b9e82f" ⋮  }Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "2519deaf-4612-4c70-aba2-d9080ae3c816" ⋮  } - Completed in 0.13s
 - Completed in 0.6s
 - Completed in 0.6s
> 1. Cognito Sync- Service ID: Cognito Sync- API Endpoint Prefix: cognito-sync- ARN Namespace: cognito-sync
2. Cognito Identity Provider- Service ID: Cognito Identity Provider- API Endpoint Prefix: cognito-idp- ARN Namespace: cognito-idp
3. Cognito Identity- Service ID: Cognito Identity- API Endpoint Prefix: cognito-identity- ARN Namespace: cognito-identity
 ▸ Time: 12s
[OSCAL] > show me everything in the EC2 component definition
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "component_definition_filter": "Elastic Compute Cloud (EC2)", ⋮    "query_type": "all" ⋮  } - Completed in 0.14s
> The EC2 component definition contains 1 component:
Component: EC2- UUID: 66345eb9-7c0d-435c-b2b5-675fd977de80- Type: service- Description: Empty
Properties:- Service ID: EC2- Version: 2016-11-15- Availability: REGIONAL and ZONAL- Full Name: Elastic Compute Cloud (EC2)- API Endpoint Prefix: ec2- ARN Namespace: ec2
Regional Availability (34 regions):Africa (Cape Town), Asia Pacific (Hong Kong, Tokyo, Seoul, Osaka, Mumbai, Hyderabad, Singapore, Sydney, Jakarta, Melbourne, Malaysia), Canada (Central, Calgary), China (Beijing, Ningxia), Europe (Frankfurt, Zurich, Stockholm, Milan, Spain, Ireland, London, Paris), Israel (Tel Aviv), Middle East (UAE, Bahrain), South America (Sao Paulo), US East (N. Virginia, Ohio), AWS GovCloud (US-East, US-West), US West (N. California, Oregon)
 ▸ Time: 10s
[OSCAL] > what's the ID of the Jakarta region?
> Based on the EC2 component data I just retrieved, the Jakarta region's resource fragment ID is:
8041109b-0a0b-46cc-bddb-91d703667637
This is the UUID for the "Asia Pacific (Jakarta)" region component.
 ▸ Time: 3s
[OSCAL] > get the region ID from that component
Running tool query_component_definition with the param (from mcp server: oscal-dev) ⋮  { ⋮    "query_type": "by_uuid", ⋮    "query_value": "8041109b-0a0b-46cc-bddb-91d703667637" ⋮  } - Completed in 0.13s
> The region ID for Jakarta is: ap-southeast-3
 ▸ Time: 7s
[OSCAL] > /quit