Coso Mcp

io.github.simonmak-ascent由 GitHub 帳號 simonmak-ascent 發布v0.1.1更新於 Oct 24, 2026

Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.

發布方自己的服務：Coso Mcp

已驗證Streamable HTTP可網頁執行資料與分析商業與電商

概覽

AI 產生的概覽

一個開放的內控審查 MCP 伺服器，依 COSO 架構支援從範圍界定、風險評估到抽樣、測試、工作底稿與缺失報告的完整流程。

可以做什麼
查詢 COSO 架構資料：五要素、17 項原則、目標類別與聲明，並提供原則/要素涵蓋指標與五要素整合檢查。建立與管理審查專案、範圍項目、風險與控制，並檢視每個專案的附加式稽核日誌。登錄母體、計算建議樣本量，並進行帶隨機種子的可重現抽樣。記錄測試結果與例外，彙編 Markdown 工作底稿，新增與解決複核意見，並以編製人或複核人身分簽署。對缺失進行分類與彙總，並產生 Markdown 審查報告。
適用情境
適合在助手協助規劃或記錄依 COSO ICIF-2013 的內部控制或 ICFR 審查時使用，需要結構化、可追溯的產出而非自由文字。也適合在界定範圍前了解架構的要素與原則。
執行需求
可透過 npm 套件以 npx 在本機以 stdio 執行，需要 Node.js；也可連線至託管的 streamable HTTP 端點。託管端點開放、無需帳號，未宣告任何環境變數或請求標頭。
安裝前請注意
伺服器聲明其內容不構成審計或法律意見，工作底稿與評估須經合格專業人員複核後方可用於審計文件。寫入類工具會建立專案、風險、控制、樣本、測試結果與簽署；在託管端點上這些操作執行於臨時、限流的按工作階段沙箱中且不會持久保存，工作階段之間的工作會遺失。簽署時會提示同一人兼任編製與複核的獨立性問題。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Coso Mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.simonmak-ascent%2Fcoso-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "coso": {
      "type": "http",
      "url": "https://internal-control.ascent-partners.com/mcp"
    }
  }
}

README

coso-mcp

[npm] [license: MIT] [MCP]

An open Model Context Protocol server for internal-control reviews under the COSO Internal Control—Integrated Framework (ICIF-2013). It covers the full review lifecycle — scope → risk assessment → control register → population → sampling → testing → workpapers → review sign-off → deficiency evaluation → report — grounded in the framework's 5 components, 17 principles and points of focus.

  • Local: runs over stdio (npx @simonmak-ascent/coso-mcp).
  • Hosted: public endpoint at https://internal-control.ascent-partners.com/mcp (reference + read tools, plus an ephemeral per-session sandbox for the full write lifecycle — nothing persists).

Not audit or legal advice. This server assists with internal-control review methodology. All workpapers and assessments must be reviewed by qualified professionals before use in audit documentation.

Why this exists (competitive advantage)

Existing MCP servers either expose a vendor's GRC records (read-mostly, proprietary, product-shaped) or cover ISO 27001 / security controls. None runs a traceable COSO review. coso-mcp is the first COSO/ICFR-native, write-capable, open MCP for the whole lifecycle.

Dimensioncoso-mcpVendor GRC MCPs (Workiva, Vanta, Drata, Optro, OpenPages, LogicGate…)Community MCPs (iso27001-mcp, unidoc/isms, mcp-server-scf…)AI skills (sox-testing / audit-support)
COSO ICIF-2013 native (5 components / 17 principles / points of focus)✅ core engine❌ product objects❌ ISO/SCF-shaped⚠️ text only
Full lifecycle to signed workpaper✅❌ retrieval; Workiva GRC tools are read-only❌ planning/findings at best⚠️ templates, not executable
Write/stateful workpapers + preparer/reviewer sign-off + audit trail✅❌ mostly read❌❌
Framework effectiveness (principle/component present & functioning)✅❌❌❌
Deterministic, reproducible computation (sample-size tables, seeded selection)✅partial❌❌ (freeform)
Open source + open access (MIT, public endpoint, no account)✅❌ paid platform⚠️ some OSS⚠️ not a server

Moat: it is the lifecycle layer, not the data layer — it can sit on top of Workiva/Vanta/Drata rather than compete for their data; its sampling and deficiency math are computed, not improvised; and openness gives zero-friction distribution no gated vendor can match.

Tools

ToolKindPurpose
get_server_inforeadServer identity, framework coverage, disclaimer.
list_componentsreadThe five COSO components.
list_principlesreadThe 17 principles (optionally filtered by component).
get_principlereadA principle by number or slug, with paraphrased points of focus.
get_componentreadA component by id, with its principles.
list_objective_categoriesreadOperations / reporting / compliance.
list_assertionsreadThe CEAVOP assertions used to frame control objectives.
create_engagementwriteCreate a review engagement.
get_engagementreadGet an engagement by id.
list_engagementsreadList engagements.
add_scope_itemwriteAdd a significant account/process to scope.
list_scope_itemsreadList scope items.
register_riskwriteRegister a risk to objectives (likelihood, assertions, principles, fraud).
list_risksreadList registered risks.
register_controlwriteRegister a control (type, frequency, linked risks, assertions).
list_controlsreadList registered controls.
get_audit_logreadAppend-only audit events for an engagement.
compute_sample_sizereadRecommended sample size from frequency × risk, with rationale.
create_populationwriteRegister a population (item list or declared size, bounded).
list_populationsreadList populations.
select_samplewriteSeeded, reproducible sample selection (random/systematic/targeted/haphazard).
record_test_resultwriteRecord attribute-level outcomes (pass/fail/na) and a conclusion.
list_test_resultsreadList test results.
note_exceptionwriteRecord an exception with root cause and impact.
list_exceptionsreadList exceptions.
assemble_workpaperwriteAssemble a Markdown control-testing workpaper.
list_workpapersreadList workpapers.
get_workpaperreadGet a workpaper with its Markdown.
add_review_notewriteAdd a reviewer note.
resolve_review_notewriteResolve a reviewer note.
sign_offwritePreparer/reviewer sign-off (warns on same-person independence).
get_activity_logreadAppend-only activity log for an engagement.
classify_deficiencywriteClassify a deficiency (deficiency / significant / material weakness).
list_deficienciesreadList deficiencies.
aggregate_deficienciesreadGroup and flag deficiencies that may aggregate.
assess_principlereadCoverage indicators for one COSO principle.
assess_componentreadCoverage indicators for one COSO component.
framework_integration_checkreadCheck all five components have coverage.
generate_reportreadGenerate the Markdown review report.

Resources: coso://framework/icif-2013 (framework reference), coso://engagement/{id} (engagement bundle: scope, risks, controls). Prompts: scope-review, assess-risk, build-control-matrix, draft-test-workpaper, evaluate-deficiencies.

Usage

Local (stdio)

bash
npx -y @simonmak-ascent/coso-mcp

Claude Desktop / generic MCP client config:

json
{  "mcpServers": {    "coso": {      "command": "npx",      "args": ["-y", "@simonmak-ascent/coso-mcp"]    }  }}

Hosted (streamable HTTP)

https://internal-control.ascent-partners.com/mcp

The hosted endpoint is open. Write operations run in an ephemeral, isolated, rate-limited per-session sandbox and are not persisted.

Development

Compute runs on a box, never locally: cs run "<cmd>".

bash
pnpm installpnpm typecheckpnpm testpnpm test:coveragepnpm build        # tsc

Security

See SECURITY.md. Report vulnerabilities privately — do not open a public issue.

Contributing

See CONTRIBUTING.md and the Code of Conduct.

License

MIT © Simon Mak / Ascent Partners Group Limited.

來源：README.md，提交 21c780e

工具

0
SourceWeft 尚未讀取此伺服器的工具。

版本歷史

1
  1. v0.1.1最新Oct 12, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式必需10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Ascent-Partners 整合

Coso Mcp

com.ascent-partners官方發布者

一個開放的內控審查 MCP 伺服器，依 COSO 架構支援從範圍界定、風險評估到抽樣、測試、工作底稿與缺失報告的完整流程。

Streamable HTTP可網頁執行
資料與分析尚未收錄Oct 25, 2026

Startup Valuation MCP Server

com.ascent-partners官方發布者

計算新創公司估值：14 個工具涵蓋 80 多個早期、產業與股權公式，可本機執行或使用託管端點。

Streamable HTTP可網頁執行
金融14 個工具Nov 4, 2026

Intangible Asset Valuation MCP Server

com.ascent-partners官方發布者

透過 14 個工具、124+ 條教材公式計算無形資產評價，涵蓋智慧財產、技術、商譽、PPA 與減損。

Streamable HTTP可網頁執行
金融14 個工具Oct 24, 2026

HKEx Filings

com.ascent-partners官方發布者

以唯讀方式存取港交所即時申報文件：依日期區間搜尋、瀏覽分類統計，並下載文件擷取內文與表格。

Streamable HTTP可網頁執行
網頁搜尋與抓取4 個工具Nov 4, 2026

Fair Value MCP Server

com.ascent-partners官方發布者

金融估值 MCP 伺服器，提供 14 個 calculate_* 工具，涵蓋 DCF、WACC、選擇權、信用風險、精算與結構型商品，並附 IFRS/IVS 條款引用。

Streamable HTTP可網頁執行
金融14 個工具Oct 24, 2026