ComplianceCow MCP Server

Attach a rule to a specific control in an assessment.

🚨 CRITICAL EXECUTION BLOCKERS — DO NOT SKIP 🚨 Before any part of this tool can run, five preconditions MUST be met:

1. Control Verification:

• You MUST verify the control exists in the assessment by calling verify_control_in_assessment().

• Verification must confirm the control is present, valid, and a leaf control.

• If verification fails → STOP immediately. Do not proceed.

2. Rule ID Resolution:

• If rule_id is a valid UUID → proceed.

• If rule_id is an alphabetic string → treat it as the rule name and resolve it to a UUID using fetch_cc_rule_by_name().

• If resolution fails or rule_id is still not a UUID after this step → STOP immediately.

• Execution is STRICTLY PROHIBITED with a plain name.

3. Rule Publish Validation:

• You MUST check if the rule is published in ComplianceCow before proceeding.

• If the rule is not published → STOP immediately.

• Published status is a hard requirement for attachment.

4. Evidence Creation Acknowledgment:

• Before proceeding, you MUST request confirmation from the user about create_evidence.

• Ask: "Do you want to auto-generate evidence from the rule output? (default: True)"

• Only proceed after the user explicitly acknowledges their choice.

5. Override Acknowledgment:

• If the control already has a rule attached, you MUST request user confirmation before overriding.

• Ask: "This control already has a rule attached. Do you want to override it? (yes/no)"

• Only proceed if the user explicitly confirms.

RULE ATTACHMENT WORKFLOW:

1. Perform control verification using verify_control_in_assessment() (MANDATORY).

2. Resolve rule_id using the CRITICAL EXECUTION BLOCKERS above (use fetch_cc_rule_by_name() when needed).

3. Validate that the rule is published in ComplianceCow.

4. Confirm evidence creation preference from the user (acknowledgment REQUIRED).

5. Check for existing rule attachments and request override acknowledgment if needed.

6. Attach rule to control.

7. Optionally create evidence for the control.

ATTACHMENT OPTIONS:

• create_evidence: Whether to create evidence along with rule attachment. Must be confirmed by the user before proceeding.

VALIDATION REQUIREMENTS:

• Control must be verified and confirmed as a leaf control.

• Rule must be published.

• Rule ID must be a valid UUID.

• Assessment and control must exist.

• User must acknowledge override before replacing an existing rule.

Args: rule_id: ID of the rule to attach (UUID). If an alphabetic string is provided, it MUST be resolved to a UUID using fetch_cc_rule_by_name() before the tool proceeds. assessment_name: Name of the assessment. control_id: ID of the control. create_evidence: Whether to create auto-generated evidence from the rule output (default: True). ⚠️ MUST be confirmed by user acknowledgment before execution.

Returns: Dict containing attachment status and details.