Get the full record for one ISM control by identifier (e.g. ism-1781).

Identifier input is tolerant: ISM-1781, bare 1781, and legacy labels resolve to the canonical OSCAL id. Returns the control record with title, control text, section, topic, classification applicability, and Essential Eight maturity flags. Fails when nothing matches. Use ism_search or ism_applicable first when the identifier is unknown. Defaults to the active ISM version. Pass version (see ism_versions) for a historical one.

Full-text keyword search (FTS5 BM25) over ISM control text and topics.

Best when you already know the terms, an exact phrase, or part of a control title. To rank controls against a free-text description of work, use ism_applicable instead. FTS operators in the query are neutralised, so input matches literally. Returns {query, count, results} with full control records. limit defaults to 10 (capped at 200). Defaults to the active ISM version.

List controls that apply at a given classification level.

classification takes canonical abbreviations only: NC, OS, P, S, or TS (see ism_list_classifications for the OFFICIAL through TOP_SECRET mapping). Returns {classification, count, identifiers} with ids only. Fetch full records with ism_get. An unknown level fails.

List all distinct topic strings present in the ISM.

The vocabulary for the topic argument of ism_list_by_topic. Returns {count, topics} for the active version unless version is passed.

List controls under a specific topic (exact match, use ism_list_topics to enumerate).

Returns {topic, count, identifiers} with ids only. Fetch full records with ism_get. An unknown topic returns an empty list, not an error.

Report database state: active ISM version, version and control counts, db path.

Takes no arguments. Useful as a first call to confirm data is ingested and see which ISM release the other tools will answer from. For the full version list use ism_versions.

List loaded ISM versions, newest first. The vocabulary for version/from/to arguments.

Returns {active, count, versions} where each entry carries version, label, published date, control_count, and git_tag. Call this before passing version, from_version, or to_version to other tools.

List the distinct ISM Section values, the vocabulary for the tags filter on ism_applicable.

Returns {count, sections} for the active version unless version is passed.

Return the classification vocabulary as parallel lists.

canonical[i] (NC, OS, P, S, TS) pairs with friendly[i] (OFFICIAL through TOP_SECRET). ism_applicable accepts either form. ism_list_by_classification accepts canonical only. Static data, no database read.

Return the Essential Eight maturity levels: ML1, ML2, ML3.

The Essential Eight is the ASD's baseline set of mitigation strategies, and only controls belonging to it carry a maturity rating. These levels are the vocabulary for the maturity filter on ism_applicable and for coverage manifest scope. Static data, no database read.

Catalog delta between two ISM versions.

Defaults compare the version before active (from) to the active version (to), so a bare call answers 'what changed in the latest release'. change_types narrows the buckets (added, removed, reworded, retitled, moved, applicability_changed, maturity_changed) and sets unrequested buckets to null. Returns {from, to, summary, changes}. Fails on unknown versions. Use ism_versions to see loadable versions, and ism_history for one control's timeline instead of the whole catalog.

Show one control's evolution across every loaded ISM version.

Returns a chronological timeline of changes to that single control. Identifier input is tolerant like ism_get. An unknown id returns an empty timeline with a hint rather than an error. For the whole-catalog delta between two versions, use ism_diff instead.

Rank ISM controls relevant to a free-text description of planned or current work.

The primary discovery tool. Describe the work in a sentence or two and it returns the most relevant controls. For exact keyword or phrase lookup, use ism_search. Uses hybrid retrieval (semantic embeddings + FTS5 BM25) fused with Reciprocal Rank Fusion. Optional filters: classification (NC|OS|P|S|TS or OFFICIAL through TOP_SECRET), maturity (ML1|ML2|ML3, Essential Eight controls only, so leave it unset unless scoping to the Essential Eight), tags (validated against ism_list_sections), paths (repo paths whose tokens expand the lexical query). Invalid filter values fail. limit defaults to 20 (capped at 200). verbose populates each control's guideline text, null otherwise. score is a normalised RRF score in [0.0, 1.0], not a probability.

Read the project's coverage manifest (.ism-coverage.toml). Never writes.

Returns scope, summary counts, and curated entries. Walks up from cwd to find the manifest if project_path is omitted and fails when none is found. status_filter narrows the controls map to a single status (covered|partial|not-applicable|deferred) while summary stays unfiltered. To see what is missing rather than what is curated, use ism_coverage_gaps.

Create or update one entry in the coverage manifest (.ism-coverage.toml).

The only tool that writes to disk. It rewrites the manifest file atomically and an existing entry for the identifier is replaced whole. status must be one of covered, partial, not-applicable, or deferred. Validates identifier against the ISM DB, requires every attachment path to resolve on disk and every url and attachment to carry a description. last_reviewed defaults to today. Returns the action taken plus warnings and fails on validation errors.

Return outstanding in-scope controls (uncurated, partial, deferred). Never writes.

The complement of ism_coverage_read: read reports what is curated, gaps reports what is missing. Reads the manifest (.ism-coverage.toml), walking up from cwd when project_path is omitted. If work is supplied, runs ism_applicable with the project's scope as filters and intersects with the manifest to return work-relevant gaps ranked by relevance score. Without work, returns the full outstanding set ordered uncurated > partial > deferred.

Report what a newer ISM version means for the project's coverage. Never writes.

Buckets covered/partial entries into re_review (control changed since it was assessed), removed_upstream (control gone at target), and new_uncovered (now in scope, no entry). target_version defaults to scope.baseline_version or the active version. Reads the manifest like ism_coverage_read, walking up from cwd when project_path is omitted. Run this after ingesting a new ISM release, then curate the buckets with ism_coverage_upsert.