control_lookup

Instructions

Implementation Reference

• src/tools/compliance/control-lookup.ts:49-69 (handler)

  The handleControlLookup function executes the tool logic: validates input via Zod schema, calls Anthropic Claude with a detailed system prompt about NIST 800-53 Rev 5 controls, and returns the AI-generated response.

  export async function handleControlLookup(args: unknown): Promise<string> {
    return runTool('control_lookup', args, Schema, async ({ controlId, azureContext }) => {
      const contextNote = azureContext ? `\n\nAzure Environment Context: ${azureContext}` : '';
  
      const response = await anthropic.messages.create({
        model: MODEL,
        max_tokens: getTokenBudget('control_lookup'),
        system: CONTROL_SYSTEM,
        messages: [
          {
            role: 'user',
            content: `Provide the complete reference for NIST 800-53 Rev 5 control: **${controlId}**${contextNote}
  
  Include all enhancements and their FedRAMP baseline applicability.`,
          },
        ],
      });
  
      return response.content[0].type === 'text' ? response.content[0].text : '';
    });
  }

• src/tools/compliance/control-lookup.ts:25-33 (schema)

  Zod validation schema requiring controlId (NIST format regex) and optional azureContext (max 500 chars).

  const Schema = z.object({
    controlId: z
      .string()
      .regex(
        /^[A-Z]{2}-\d{1,2}(\(\d{1,2}\))?$/,
        'Control ID must be NIST format: e.g. AC-2, SC-28, AC-2(1)'
      ),
    azureContext: z.string().max(500).optional(),
  });

• src/tools/compliance/control-lookup.ts:5-23 (registration)

  Tool definition object with name 'control_lookup', description, and JSON Schema inputSchema (controlId required, azureContext optional).

  export const controlLookupTool = {
    name: 'control_lookup',
    description:
      'Look up any NIST 800-53 Rev 5 control and get the full requirement text, Azure implementation guidance, FedRAMP inheritance model, and a copy-ready eMASS narrative starter.',
    inputSchema: {
      type: 'object' as const,
      properties: {
        controlId: {
          type: 'string',
          description: 'NIST 800-53 control ID — e.g. "AC-2", "SC-28", "AC-2(1)"',
        },
        azureContext: {
          type: 'string',
          description: 'Optional: describe your Azure environment for context-specific guidance',
        },
      },
      required: ['controlId'],
    },
  };

• src/tools/index.ts:3-64 (registration)

  Import and registration of controlLookupTool in the allTools array, plus the switch-case routing at line 64 mapping 'control_lookup' to handleControlLookup.

  import { controlLookupTool, handleControlLookup } from './compliance/control-lookup.js';
  import { controlNarrativeTool, handleControlNarrative } from './compliance/control-narrative.js';
  import { poamGenerateTool, handlePoamGenerate } from './compliance/poam-generate.js';
  import { atoReadinessTool, handleAtoReadiness } from './compliance/ato-readiness.js';
  import { oscalFragmentTool, handleOscalFragment } from './compliance/oscal-fragment.js';
  
  import { landingZoneTool, handleLandingZone } from './architecture/landing-zone-design.js';
  import { landingZoneReferenceTool, handleLandingZoneReference } from './architecture/landing-zone-reference.js';
  import { serviceSelectTool, handleServiceSelect } from './architecture/azure-service-selector.js';
  import { gccHighTool, handleGccHigh } from './architecture/gcc-high-guidance.js';
  import { privateEndpointTool, handlePrivateEndpoint } from './architecture/private-endpoint-map.js';
  
  import { bigbangValidateTool, handleBigbangValidate } from './platform-one/bigbang-validate.js';
  import { bigbangHardenTool, handleBigbangHarden } from './platform-one/bigbang-harden.js';
  import { ironbankLookupTool, handleIronbankLookup } from './platform-one/ironbank-lookup.js';
  import { addonConfiguratorTool, handleAddonConfigurator } from './platform-one/addon-configurator.js';
  
  import { pipelineAuditTool, handlePipelineAudit } from './pipeline/pipeline-audit.js';
  import { signingConfigTool, handleSigningConfig } from './pipeline/signing-config.js';
  import { devsecopsScoreCardTool, handleDevsecopsScorecard } from './pipeline/devsecops-scorecard.js';
  
  import { sspSectionTool, handleSspSection } from './documents/ssp-section.js';
  import { contingencyPlanTool, handleContingencyPlan } from './documents/contingency-plan.js';
  
  import { govcloudQuickstartTool, handleGovcloudQuickstart } from './govcloud-quickstart.js';
  
  export const allTools = [
    // Compliance
    bicepAnalyzeTool,
    bicepRemediateTool,
    controlLookupTool,
    controlNarrativeTool,
    poamGenerateTool,
    atoReadinessTool,
    oscalFragmentTool,
    // Architecture
    landingZoneTool,
    landingZoneReferenceTool,
    serviceSelectTool,
    gccHighTool,
    privateEndpointTool,
    // Platform One
    bigbangValidateTool,
    bigbangHardenTool,
    ironbankLookupTool,
    addonConfiguratorTool,
    // Pipeline
    pipelineAuditTool,
    signingConfigTool,
    devsecopsScoreCardTool,
    // Documents
    sspSectionTool,
    contingencyPlanTool,
    // Meta
    govcloudQuickstartTool,
  ];
  
  export async function handleToolCall(name: string, args: unknown): Promise<string> {
    switch (name) {
      case 'bicep_analyze':         return handleBicepAnalyze(args);
      case 'bicep_remediate':       return handleBicepRemediate(args);
      case 'control_lookup':        return handleControlLookup(args);

• src/utils/tool-runner.ts:18-18 (helper)

  Token budget configuration for control_lookup (4096 tokens) and timeout configuration (30000ms) in the tool-runner utility.

  control_lookup: 4096,