compliance-aiops

Overview Schema Source Related Servers Discussions Admin

oscal_assessment_results

Read-only

Converts a sealed compliance evidence bundle into an OSCAL 1.2.3 Assessment Results document, surfacing partial evidence and limitations for audit-ready reporting.

Instructions

[READ] A sealed bundle as an OSCAL 1.2.3 Assessment Results document.

Returns the document inline (writing a file is export_bundle's job) with a summary and an explicit limitations list. Three things OSCAL cannot express are handled rather than hidden: import-ap points at a back-matter resource saying no assessment plan exists; control ids are framework-native and NOT resolved against an imported catalog; and because status has only satisfied/not-satisfied, controls this tool evidences only PARTIALLY are reported satisfied with an evidence-strength prop plus remarks naming what the audit trail does not prove — the count is in summary so it cannot be skimmed past.

UUIDs are deterministic (v5, derived from the bundle's chain head), so re-exporting the same bundle produces a byte-identical document.

Args: bundle_path: Path to a bundle .json (from list_bundles).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "bundle_path": "<bundle_path>"
    },
    "name": "oscal_assessment_results"
  }
}

Input Schema

Name	Required	Description	Default
`bundle_path`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Addedv0.10.0Aug 12, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Reads far past the readOnlyHint annotation: it discloses how import-ap is represented when no assessment plan exists, that control ids are framework-native and unresolved against a catalog, how partial evidence is downgraded to 'satisfied' with an evidence-strength prop, and that deterministic v5 UUIDs make re-export byte-identical. It also warns that the partial-evidence count sits in `summary` specifically so it cannot be skimmed past.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the read marker and the core purpose, then organized into the three OSCAL limitations and the args block. Dense but every sentence carries information; the trailing args note is slightly redundant given the schema already lists bundle_path.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return shape itself: an inline document with a summary and an explicit limitations list. It also covers determinism and the 'sealed bundle' prerequisite, giving an agent enough to call this correctly without inspecting the implementation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% for the single bundle_path parameter, so the description must compensate. It does so usefully by specifying the file type (.json) and the source tool (list_bundles), but it adds no path format, absence-of-file, or validation behavior beyond that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb+resource and target format: converts a sealed bundle into an OSCAL 1.2.3 Assessment Results document. It explicitly distinguishes itself from the nearest sibling by noting that writing a file is export_bundle's job, so an agent can route between the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the alternative (export_bundle) and the condition that selects it (inline return vs. file writing), which is strong routing guidance. It stops short of stating when to prefer this tool over, say, coverage_summary or control_evidence, and gives no explicit when-not-to-use condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.