ISM MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HOST | No | Host for HTTP server (when MCP_TRANSPORT=http). | 0.0.0.0 |
| PORT | No | Port for HTTP server (when MCP_TRANSPORT=http). | 8080 |
| MCP_HTTP_PATH | No | URL path for MCP endpoint (when MCP_TRANSPORT=http). | /mcp |
| MCP_TRANSPORT | No | Transport type: stdio (default) or http. | stdio |
| ISM_MCP_CACHE_DIR | No | Override on-disk cache directory. | ~/.cache/ism-mcp/ |
| ISM_MCP_TAGS_TTL_MS | No | Tag-list cache TTL in milliseconds (default 6h). | 21600000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_versionsB | Lists every published ISM release (historical, current, and any future tags as soon as they appear upstream). Returns tag, version id, commit SHA, and release date parsed from the tag. |
| get_version_metadataA | Returns OSCAL metadata (title, version, last-modified, oscal-version) for a given ISM release. Use "latest" or omit to get the most recent. |
| list_groupsB | Returns the hierarchical group structure of the ISM catalog (chapters, guidelines, sections) with control counts at each level. |
| list_controlsC | Returns a paginated, filtered list of ISM controls. Supports filters by applicability, group/section name (substring), and label prefix (e.g. "GOV", "AC", "PHYS"). |
| search_controlsA | Full-text search across ISM control labels, titles, statements, and group paths. Combine with applicability/group/labelPrefix filters. |
| get_controlA | Returns the full detail (title, group path, applicability, statement) for a single ISM control. Accepts either the OSCAL id (e.g. ism-principle-gov-01) or the human label (e.g. GOV-01). |
| get_controlsB | Returns full detail for multiple ISM controls in one call. Accepts OSCAL ids and/or human labels (e.g. GOV-01). |
| compare_versionsA | Computes the diff between two ISM releases: controls added, removed, and modified (title, statement, or applicability changes). Useful for change-management and gap analysis. |
| list_profilesA | Lists the OSCAL profiles published alongside each ISM release: the five classification baselines (NC, OS, P, S, TS) and the three Essential Eight maturity levels (ML1, ML2, ML3). |
| get_profile_controlsB | Returns the resolved set of controls included in a given ISM OSCAL profile (classification baseline or Essential Eight maturity level) for a given version. |
| cache_infoA | Reports the bundled offline data directory, the writable user cache directory, sizes, file counts, and whether the server is running in offline mode (ISM_MCP_OFFLINE). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| ism_compliance_check | Generate a structured ISM compliance assessment for a system description against a chosen baseline. |
| ism_change_brief | Produce a change-management brief between two ISM releases, focused on impact and required actions. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool has a clearly distinct purpose: cache_info handles offline cache, compare_versions diffs releases, get_control/get_controls retrieve details, get_profile_controls gets controls for profiles, get_version_metadata gets release metadata, list_controls filters controls, list_groups shows hierarchy, list_profiles lists baselines, list_versions lists releases, and search_controls performs full-text search. No two tools have overlapping functionality.
All tool names follow a consistent verb_noun pattern in snake_case: cache_info, compare_versions, get_control, get_controls, get_profile_controls, get_version_metadata, list_controls, list_groups, list_profiles, list_versions, search_controls. The verbs are descriptive and the nouns clearly indicate the resource.
11 tools is well-scoped for an ISM reference server. It provides sufficient granularity for querying, searching, listing, and comparing controls, profiles, and versions without being excessive or minimal.
The tool set covers all essential operations for exploring the ISM catalog: retrieving individual or multiple controls, listing with filters, full-text search, accessing version metadata, listing versions and profiles, getting profile controls, comparing releases, and checking cache status. No obvious gaps for a read-only reference server.