Scans Infrastructure-as-Code for security misconfigurations and maps each finding to a SOC 2 Trust Services Criterion. Supports Terraform, CloudFormation, Kubernetes, Dockerfile, Helm, ARM and Bicep via a locally installed Checkov or Trivy.

The scan runs entirely on this machine. File contents are never transmitted anywhere.

Returns a SUMMARY AND A HANDOFF, not the findings themselves -- a real repository produces hundreds of findings. Call list_findings with the returned batchId to page through them, then get_finding for detail on a specific one.

The path MUST be absolute. Run pwd in the target directory if you need it.

Scope: SOC 2 Security category only. All 33 Common Criteria are catalogued, but an IaC scan is the primary evidence source for just 3 of them and partially informs 8 more -- the remaining 22 are out of reach of any infrastructure scan and need documents, people, or live cloud state. This server does not support ISO 27001, HIPAA, PCI, NIST or GDPR. Do not claim coverage it does not have.

Pages through findings from a previous scan_iac call. Returns lightweight rows; call get_finding for full detail on one.

Findings with UNKNOWN severity are never filtered out by minSeverity. Checkov's open-source build often omits severity metadata, and dropping those findings would under-report real misconfigurations.

Returns a single finding with its SOC 2 control mapping (including how the mapping was derived and how confident it is), blast-radius classification, and remediation guidance.

Maps a scanner check to a SOC 2 Trust Services Criterion without running a scan. Useful for checks surfaced by another tool, CI output, or a scanner this server does not wrap.

Always returns mappingSource and confidence. A low confidence mapping is a keyword match that the resource type did not corroborate -- verify it before relying on it. unmapped means no rule matched; that is a real answer, not a failure.

Returns the SOC 2 control catalog this server evaluates against. Pass controlId for one control; omit it for all.

Scope is the SOC 2 Security category, which is all 33 Common Criteria (CC1.1-CC9.2). The optional A / C / PI / P categories are NOT covered.

An IaC scan is the primary evidence source for only 3 of the 33 and partially informs 8; the remaining 22 need documents, people or live cloud state. Each control reports what a scan can and cannot evidence for it via its iac capability and iacNote.

Collapses a list of findings into deduplicated action items and classifies each by how widely the fix applies: account-wide (fix once), per-region (rollout), per-resource (each resource), or per-person (human coordination).

This is what turns '400 findings' into '9 action items across 400 resources'. Pass a batchId to classify a whole scan, or pass findings inline to classify results from elsewhere.

Pure and offline: no scan, no network.

Reports which IaC scanners are installed, which control framework is supported, and which trusted roots this server will scan. Call this first when a scan fails.

Answer eight questions about how your company is set up and get back, for each of the 33 SOC 2 Common Criteria, what satisfying it actually looks like for a company shaped like yours and which ones to deal with first. Fully local and deterministic; no account, no network call, no model. Call applicability_questions first to get the question list. IMPORTANT: this does not remove criteria from scope — all 33 apply to essentially every SOC 2 Security engagement. It tells you what each one means for you and what to prioritise.

Returns the eight questions used by applicability_brief, with the allowed values for each and why each question is asked. Ask the user these conversationally, then call applicability_brief.

Takes a finding from a scan and explains it without jargon: what it actually means, the real-world risk of ignoring it, why an auditor would care, what to change, and roughly what shape of work the fix is. Everything returned is derived from the finding itself — severity, control mapping and its confidence, blast radius — so it never invents a risk claim. Where the data is missing or the mapping is weak, it says so.

Builds a per-criterion evidence summary from a scan, suitable for showing a prospect's security team. Every row traces to the file, line, rule ID, mapping confidence and timestamp behind it, and the document carries a fingerprint the viewer can recompute. This returns DATA ONLY — nothing is published and no file is written. It never emits a compliance badge or the words 'compliant' or 'certified': SOC 2 is an attestation that only a licensed CPA firm can issue, and this is an automated scan.

Returns the trust page as a complete HTML or Markdown document, as a STRING. This server never writes files — save it yourself, or ask your agent to write it so the diff goes through your normal approval step. The HTML is fully self-contained: no CDN, no webfont, no analytics, no script, no external request of any kind, because a trust page that phones home would be flagged in exactly the security review it exists to serve.

Reports which cloud/VCS CLIs are authenticated on this machine and whether those credentials are WRITE-CAPABLE. This matters because 'read-only' is two separate claims: that this server performs no write operations (true, and verifiable by code inspection), and that the credential itself cannot write (a property of the token, which this server does not control when it inherits your ambient CLI session). Use this before telling anyone the integration is read-only. Never reads, stores, or transmits a token value — it asks each CLI what it is already logged in as.

Emits the scan as a NIST OSCAL assessment-results document (JSON), the machine-readable format used by GRC platforms and assessment tooling. Returned as a STRING; this server writes no files. Two deliberate limitations are stated inside the document itself: no official OSCAL catalog for SOC 2 exists, so criterion IDs are used descriptively; and only 'not-satisfied' findings are ever emitted — this tool never asserts 'satisfied', because the absence of a scanner finding is not evidence that a criterion is met.

Produces a policy DRAFT in Markdown, grounded in the answers you gave to applicability_brief and, optionally, a real scan. Returned as a string; this server writes no files. Every judgment call is left as an explicit {{PLACEHOLDER}}, counted and returned separately rather than silently filled with a plausible default — because a policy describing controls you do not actually operate is worse than no policy, and becomes an audit exception. The draft states in its own header that having the document does not satisfy the criteria it supports; SOC 2 also wants evidence it was approved, communicated, acknowledged and followed.

Returns the policies this server can draft, the SOC 2 criteria each contributes toward, and what else you must produce beyond the document itself for those criteria to actually be addressed.