coso-mcp

Name: coso-mcp
Author: simonmak-ascent

by io.github.simonmak-ascent

Overview Discussions Admin

Server Details

Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.

Ownership verified

Status: Healthy
Last Tested: 2026-10-12 07:00
Transport: Streamable HTTP · MCP 2025-11-25
URL
Repository: simonmak-ascent/coso-mcp
GitHub Stars: 0

TDQS

Score is being calculated.

Available Tools

39 tools

add_review_noteAdd a review noteInspect

Add a reviewer note to a workpaper.

ParametersJSON Schema

Name	Required	Description	Default
`text`	Yes
`author`	No
`workpaperId`	Yes
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`note`	Yes
`workpaper`	Yes

add_scope_itemAdd a scope itemInspect

Add a significant account/process to the review scope, with its objective category and assertions.

ParametersJSON Schema

Name	Required	Description
`area`	Yes	Significant account or process.
`inScope`	No
`rationale`	No
`assertions`	No
`engagementId`	Yes
`objectiveCategory`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`scopeItem`	Yes

aggregate_deficienciesAggregate deficienciesInspect

Group related deficiencies by control, flag combinations that may aggregate, and report the overall severity.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes
`deficiencyIds`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`aggregation`	Yes

assemble_workpaperAssemble a workpaperInspect

Assemble a Markdown control-testing workpaper from the control, its risks, population, sample, test results and exceptions.

ParametersJSON Schema

Name	Required	Description
`title`	No
`controlId`	Yes
`engagementId`	Yes
`testResultId`	No	Restrict to a single test result.

Output Schema

ParametersJSON Schema

Name	Required	Description
`workpaper`	Yes

assess_componentAssess a COSO component (indicators)Inspect

Report coverage indicators for one COSO component, aggregating its principles.

ParametersJSON Schema

Name	Required	Description	Default
`id`	Yes
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`found`	Yes
`assessment`	Yes

assess_principleAssess a COSO principle (indicators)Inspect

Report data-driven coverage indicators for one COSO principle (controls, risks and deficiencies mapped to it).

ParametersJSON Schema

Name	Required	Description	Default
`number`	Yes
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`found`	Yes
`assessment`	Yes

classify_deficiencyClassify a deficiencyInspect

Classify a control deficiency as deficiency / significant deficiency / material weakness from likelihood × magnitude (escalates for a pervasive control).

ParametersJSON Schema

Name	Required	Description	Default
`title`	Yes
`controlId`	No
`magnitude`	Yes
`pervasive`	No
`likelihood`	Yes
`description`	Yes
`remediation`	No
`engagementId`	Yes
`exceptionIds`	No
`testResultId`	No
`compensatingControl`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`deficiency`	Yes

compute_sample_sizeCompute a sample sizeInspect

Recommend a sample size for a control from its frequency, risk and population size, with a documented rationale.

ParametersJSON Schema

Name	Required	Default
`risk`	No	moderate
`frequency`	Yes
`populationSize`	No
`priorDeficiency`	No
`externalReliance`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`capped`	Yes
`frequency`	Yes
`rationale`	Yes
`recommended`	Yes
`effectiveRisk`	Yes
`requestedRisk`	Yes
`populationSize`	No

create_engagementCreate an engagementInspect

Create a new internal-control review engagement. Returns the engagement id used by all later tools.

ParametersJSON Schema

Name	Required	Description
`id`	No	Optional explicit engagement id.
`title`	Yes	Engagement title.
`entity`	Yes	Entity or business unit under review.
`period`	No	Review period, e.g. 2025 or 2025-H2.
`materiality`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`engagement`	Yes

create_populationCreate a populationInspect

ParametersJSON Schema

Name	Required	Description	Default
`items`	No
`period`	No
`currency`	No
`controlId`	No
`description`	Yes
`declaredSize`	No
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`population`	Yes

framework_integration_checkFramework integration checkInspect

Check that all five COSO components have some recorded coverage and that principles are addressed.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`components`	Yes
`integration`	Yes

generate_reportGenerate the review reportInspect

Generate a Markdown internal-control review report: scope, risks, controls, testing, workpapers, deficiencies and COSO coverage.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`counts`	Yes
`markdown`	Yes

get_activity_logGet the activity logInspect

Return the append-only activity log for an engagement, plus a Markdown rendering.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`events`	Yes
`markdown`	Yes

get_audit_logGet the audit logInspect

Return the append-only audit events recorded for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`events`	Yes

get_componentGet a COSO componentInspect

Return a single COSO component by id, with its principles.

ParametersJSON Schema

Name	Required	Description	Default
`id`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`found`	Yes
`component`	Yes

get_engagementGet an engagementInspect

Return an engagement by id.

ParametersJSON Schema

Name	Required	Description	Default
`id`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`found`	Yes
`engagement`	Yes

get_principleGet a COSO principleInspect

Return a single COSO principle by framework number or slug, including its paraphrased points of focus.

ParametersJSON Schema

Name	Required	Description	Default
`id`	No
`number`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`found`	Yes
`principle`	Yes

get_server_infoInspect

Return the server identity, the COSO framework it covers, and the mandatory disclaimer.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`name`	Yes
`title`	Yes
`version`	Yes
`framework`	Yes
`disclaimer`	Yes
`description`	Yes

get_workpaperGet a workpaperInspect

Return a workpaper including its rendered Markdown.

ParametersJSON Schema

Name	Required	Description	Default
`workpaperId`	Yes
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`found`	Yes
`workpaper`	Yes

list_assertionsList audit assertions (CEAVOP)Inspect

List the assertions used to frame control objectives: completeness, existence/occurrence, accuracy, valuation, obligations/rights, presentation/disclosure.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`assertions`	Yes

list_componentsList COSO componentsInspect

List the five components of the COSO Internal Control—Integrated Framework (ICIF-2013).

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`framework`	Yes
`components`	Yes

list_controlsList controlsInspect

List the controls registered for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`controls`	Yes

list_deficienciesList deficienciesInspect

List the deficiencies recorded for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`deficiencies`	Yes

list_engagementsList engagementsInspect

List all engagement ids and titles.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`engagements`	Yes

list_exceptionsList exceptionsInspect

List the exceptions recorded for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`exceptions`	Yes

list_objective_categoriesList COSO objective categoriesInspect

List the three COSO objective categories (operations, reporting, compliance).

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`objectiveCategories`	Yes

list_populationsList populationsInspect

List the populations registered for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`populations`	Yes

list_principlesList COSO principlesInspect

List the 17 principles of the COSO ICIF-2013, optionally filtered to a single component.

ParametersJSON Schema

Name	Required	Description	Default
`component`	No	Restrict to a single component id.

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`framework`	Yes
`principles`	Yes

list_risksList risksInspect

List the risks registered for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`risks`	Yes

list_scope_itemsList scope itemsInspect

List the scope items for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`scopeItems`	Yes

list_test_resultsList test resultsInspect

List the test results recorded for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`testResults`	Yes

list_workpapersList workpapersInspect

List the workpapers assembled for an engagement.

ParametersJSON Schema

Name	Required	Description	Default
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`count`	Yes
`workpapers`	Yes

note_exceptionNote an exceptionInspect

Record an exception identified during testing, with root cause, impact and any compensating control.

ParametersJSON Schema

Name	Required	Description
`impact`	No
`reference`	Yes	The sample item reference the exception relates to.
`rootCause`	No
`description`	Yes
`engagementId`	Yes
`testResultId`	Yes
`compensatingControl`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`exception`	Yes

record_test_resultRecord a test resultInspect

Record attribute-level outcomes (pass/fail/na) for a tested sample, with an optional conclusion.

ParametersJSON Schema

Name	Required	Description
`results`	Yes
`sampleId`	Yes
`attribute`	Yes	The control attribute/objective tested.
`controlId`	Yes
`procedure`	No
`conclusion`	No
`preparedBy`	No
`engagementId`	Yes
`populationId`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`testResult`	Yes

register_controlRegister a controlInspect

ParametersJSON Schema

Name	Required	Description	Default
`key`	No
`type`	Yes
`owner`	No
`riskIds`	No
`frequency`	Yes
`assertions`	No
`principles`	No
`description`	Yes
`scopeItemId`	No
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`control`	Yes

register_riskRegister a riskInspect

ParametersJSON Schema

Name	Required	Default
`cause`	No
`fraud`	No
`impact`	No
`assertions`	No
`likelihood`	No	medium
`principles`	No
`description`	Yes
`scopeItemId`	No
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`risk`	Yes

resolve_review_noteResolve a review noteInspect

Mark a review note resolved on a workpaper.

ParametersJSON Schema

Name	Required	Description	Default
`noteId`	Yes
`resolvedBy`	No
`workpaperId`	Yes
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`note`	Yes
`workpaper`	Yes

select_sampleSelect a sampleInspect

Select a reproducible sample from a population. Seeded (deterministic) for random/systematic/haphazard; targeted takes explicit references. Records the method, seed and references.

ParametersJSON Schema

Name	Required	Description	Default
`seed`	No
`method`	Yes
`controlId`	No
`rationale`	No
`sampleSize`	No
`engagementId`	Yes
`populationId`	Yes
`targetedReferences`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`sample`	Yes

sign_offSign off a workpaperInspect

Record a preparer or reviewer sign-off. Warns (does not block) if the same person prepared and reviewed.

ParametersJSON Schema

Name	Required	Description	Default
`role`	Yes
`actor`	No
`comment`	No
`workpaperId`	Yes
`engagementId`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`warning`	No
`workpaper`	Yes

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

39 tool updatesOct 12, 2026
- First observedadd_review_note
- First observedadd_scope_item
- First observedaggregate_deficiencies
- First observedassemble_workpaper
- First observedassess_component
- First observedassess_principle
- First observedclassify_deficiency
- First observedcompute_sample_size
- First observedcreate_engagement
- First observedcreate_population
- First observedframework_integration_check
- First observedgenerate_report
- First observedget_activity_log
- First observedget_audit_log
- First observedget_component
- First observedget_engagement
- First observedget_principle
- First observedget_server_info
- First observedget_workpaper
- First observedlist_assertions
- First observedlist_components
- First observedlist_controls
- First observedlist_deficiencies
- First observedlist_engagements
- First observedlist_exceptions
- First observedlist_objective_categories
- First observedlist_populations
- First observedlist_principles
- First observedlist_risks
- First observedlist_scope_items
- First observedlist_test_results
- First observedlist_workpapers
- First observednote_exception
- First observedrecord_test_result
- First observedregister_control
- First observedregister_risk
- First observedresolve_review_note
- First observedselect_sample
- First observedsign_off

Related MCP Connectors

MCP Risk Ledger MCP
com.clauxel.mcpriskledger
Paid remote MCP for server intake risk reports, tool review, approvals, and readiness.
Security Legal & Compliance
2
aistudioworkspaceapproval-mcp
com.clauxel.aistudioworkspaceapproval
Paid remote MCP for AI Studio Workspace approval gate MCP, structured receipts, audit logs, and revi
Security Monitoring Observability
2
Trust Live
io.github.ChanghuLiu
Evidence-linked MCP selection and non-executing Safe-Call review; surfaces unknowns.
51
AuditFellowOAuth
app.auditfellow
Your audit methodology inside Claude: findings, risks, controls and workpapers in your team format.
Legal & Compliance
1

Related MCP Servers

auditoria-skills
Legal & Compliance Documentation Access
marcelinero
A
license
Not graded
quality
B
maintenance
MCP server with 20 internal-audit SKILLs grounded in global standards (IIA, COSO, NIST, ISO, IFRS, COBIT, ACFE), written in Spanish. Enables audit planning, control evaluation, and specialty audits via natural language.
Updated 11 days ago (2026-10-01 13:13 UTC)
CC BY-SA 4.0
convergeqa-mcpofficial
Research & Data Documentation Access
convergeqa
A
license
B
quality
D
maintenance
MCP servers for multi-model document review with critique/iterate and compare/due-diligence tools, using public verification receipts.
Updated 3 months ago (2026-07-12 12:57 UTC)
16
MIT
workpapers-mcp
Legal & Compliance Documentation Access
aminafara123
A
license
A
quality
C
maintenance
Enables AI clients to query and trace ITGC audit workpapers, including controls from risk to test result, findings by rating and status, and open items.
Updated 12 days ago (2026-09-30 12:40 UTC)
4
MIT
CodexRun Ledger MCPofficial
Developer Tools Project Management
clauxel
F
license
Not graded
quality
D
maintenance
Paid remote MCP for generating trustworthy code run receipts, scope summaries, missing evidence checks, and client handoff exports.
Updated 5 months ago (2026-05-19 09:43 UTC)
-

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Server Details

TDQS

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Related MCP Connectors

Related MCP Servers

auditoria-skills

convergeqa-mcpofficial

workpapers-mcp

CodexRun Ledger MCPofficial

Glama MCP Gateway

Resources