Skip to main content
Glama

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
OSCAL_DOCUMENTS_DIRNoDirectory containing your OSCAL JSON files. Not scanned when empty.
OSCAL_STORE_DB_PATHNoPath to a persistent SQLite database. When set, the index is reused across server restarts instead of being rebuilt each time.
OSCAL_STORE_CACHE_SIZENoMaximum number of parsed OSCAL documents to keep in the in-memory LRU cache.100

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": false
}
prompts
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
experimental
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
list_oscal_modelsA

List the OSCAL model names, each with description, layer, formal and short names, and release status.

Use when you need a valid model_name for get_oscal_schema or a model for the Metaschema tools.

get_oscal_schemaA

Return the JSON schema or XML Schema (XSD) of one OSCAL model as text.

Use when you need the structure of an OSCAL model: its properties, types, and required fields.

get_allowed_valuesA

Return the values OSCAL Metaschema allowed-values constraints permit at a target, with allow-other, namespace and conditions for predicates, and source file and line. Use when the JSON schema does not list the values; use get_constraints for other constraint types. Results are paged within a response budget, and an empty page lists suggested-targets.

get_constraintsA

List the OSCAL Metaschema constraints at a target (allowed-values, matches, index, index-has-key, is-unique, has-cardinality, expect) with type-specific details and source file and line; a bare definition name returns every constraint declared on it and its local definitions. Use when you need rules the JSON schema does not express; use get_allowed_values for the values themselves. Results are paged within a response budget.

find_references_toA

Find the fields, flags, props, and links that OSCAL Metaschema index-has-key constraints require to reference an assembly by key (UUID or ID), with the matching index, source file and line for both, and cross-document. Use when you need what must point to a component, party, location, or resource, including prop and link references a search for UUID fields misses. Results are paged within a response budget.

get_definitionA

Return every OSCAL Metaschema definition with a given name, with formal name, description, remarks, flags, model children, constraint summaries, and source file and line. Use when you need documentation or structure that the generated JSON and XML schemas shorten or drop. Results are paged within a response budget, and long remarks are marked truncated.

get_metaschema_sourceA

Read a line range of a bundled OSCAL Metaschema source file verbatim, or list the files with line counts when file is omitted. Use when checking a source-file and line from get_definition, get_allowed_values, get_constraints, or find_references_to. A response may hold fewer lines to fit the response budget; continue from end-line + 1 while has-more is true.

list_oscal_resourcesA

List OSCAL community resources (tools, content, articles, talks) from the awesome-oscal list, each with category and markdown text. Results are paged.

query_component_definitionA

Return OSCAL Components from loaded Component Definitions as OSCAL JSON, or one Capability when a by_uuid or by_title query matches a Capability. Use when you need component details: call it directly with by_title or by_type when you know the name or type, else find UUIDs and titles first with list_components; use list_capabilities or get_capability only for Component Definitions that contain capabilities. Results are paged.

list_component_definitionsA

List loaded Component Definitions with UUID, title, component count, and size. Use when picking a component_definition_filter for query_component_definition. Results are paged.

list_componentsA

List loaded Components with UUID, title, and parent Component Definition. Use when picking a query_value for query_component_definition. Results are paged.

list_capabilitiesA

List loaded Capabilities with UUID, name, and parent Component Definition. Use when working with Component Definitions that contain capabilities; the list is empty when none do. Results are paged.

get_capabilityA

Get one Capability by UUID as OSCAL JSON, or null when no Capability has that UUID. Use when working with Component Definitions that contain capabilities.

validate_oscal_contentA

Validate OSCAL JSON text and return per-level results for JSON syntax, JSON Schema, the OSCAL model, and oscal-cli (skipped when not installed). Later levels are skipped when the JSON does not parse.

validate_oscal_fileA

Validate an OSCAL JSON file and return per-level results for JSON syntax, JSON Schema, the OSCAL model, and oscal-cli (skipped when not installed). Use when the document is in a file; for JSON text use validate_oscal_content.

query_catalogA

Return loaded OSCAL Catalogs with metadata and childTypeCounts. For controls and groups, use list_catalog_controls or list_catalog_groups, then get_child_element.

list_catalogsA

List loaded OSCAL Catalogs with UUID, title, child count, and size. Use when picking a query_value for query_catalog. Results are paged.

query_sspA

Return loaded OSCAL SSPs with metadata and childTypeCounts. For child elements, use list_ssp_control_implementations or list_ssp_system_components, then get_child_element.

list_sspsA

List loaded OSCAL System Security Plans with UUID, title, child count, and size. Use when picking a query_value for query_ssp. Results are paged.

query_profileA

Return loaded OSCAL Profiles with metadata and childTypeCounts. For child elements, use list_profile_imports or list_profile_modify, then get_child_element.

list_profilesA

List loaded OSCAL Profiles with UUID, title, child count, and size. Use when picking a query_value for query_profile. Results are paged.

query_assessment_planA

Return loaded OSCAL Assessment Plans with childTypeCounts. For child elements, use list_assessment_plan_tasks or list_assessment_plan_activities, then get_child_element.

list_assessment_plansA

List loaded OSCAL Assessment Plans with UUID, title, child count, and size. Use when picking a query_value for query_assessment_plan. Results are paged.

query_assessment_resultsA

Return loaded OSCAL Assessment Results with childTypeCounts. For child elements, use list_assessment_results_results or list_assessment_results_findings, then get_child_element.

list_assessment_resultsA

List loaded OSCAL Assessment Results with UUID, title, child count, and size. Use when picking a query_value for query_assessment_results. Results are paged.

query_poamA

Return loaded OSCAL Plans of Action and Milestones with metadata and childTypeCounts. For POA&M items, use list_poam_items, then get_child_element.

list_poamsA

List loaded OSCAL Plans of Action and Milestones with UUID, title, child count, and size. Use when picking a query_value for query_poam. Results are paged.

query_mapping_collectionB

Return loaded OSCAL Mapping Collections with metadata and childTypeCounts. For mappings, use list_mapping_collection_mappings, then get_child_element.

list_mapping_collectionsA

List loaded OSCAL Mapping Collections with UUID, title, child count, and size. Use when picking a query_value for query_mapping_collection. Results are paged.

text_search_oscalA

Search loaded OSCAL documents and child elements, including control prose, ranked by relevance. Pass a child hit's entity ID and parentDocumentUuid to get_child_element.

list_catalog_controlsA

List controls in loaded OSCAL Catalogs with token ID (e.g. ac-1), title, and parent document. Get a control's OSCAL JSON with get_child_element. Results are paged.

list_catalog_groupsB

List control groups (families) in loaded OSCAL Catalogs with token ID, title, and parent document. Get a group's OSCAL JSON with get_child_element. Results are paged.

list_ssp_control_implementationsA

List the control-implementation element of loaded OSCAL SSPs, one per SSP. Get its OSCAL JSON with get_child_element. Results are paged.

list_ssp_system_componentsA

List system components in loaded OSCAL SSPs with UUID, title, and parent document. Get a component's OSCAL JSON with get_child_element. Results are paged.

list_profile_importsA

List imports in loaded OSCAL Profiles, with positional IDs (import-0, import-1). Get an import's OSCAL JSON with get_child_element. Results are paged.

list_profile_modifyB

List the modify element (control tailoring) of loaded OSCAL Profiles, one per profile. Get its OSCAL JSON with get_child_element. Results are paged.

list_assessment_plan_tasksA

List tasks in loaded OSCAL Assessment Plans with UUID, title, and parent document. Get a task's OSCAL JSON with get_child_element. Results are paged.

list_assessment_plan_activitiesA

List activities in loaded OSCAL Assessment Plans with UUID, title, and parent document. Get an activity's OSCAL JSON with get_child_element. Results are paged.

list_assessment_results_resultsA

List results in loaded OSCAL Assessment Results with UUID, title, and parent document. Get a result's OSCAL JSON with get_child_element. Results are paged.

list_assessment_results_findingsA

List findings in loaded OSCAL Assessment Results with UUID, title, and parent document. Get a finding's OSCAL JSON with get_child_element. Results are paged.

list_poam_itemsA

List POA&M items in loaded OSCAL POA&Ms with ID, title, and parent document. Get an item's OSCAL JSON with get_child_element. Results are paged.

list_mapping_collection_mappingsA

List mappings in loaded OSCAL Mapping Collections with UUID, title, and parent document. Get a mapping's OSCAL JSON with get_child_element. Results are paged.

get_child_elementA

Get one child element by UUID or token ID, with its OSCAL JSON in raw_json. If the result is an ambiguous_element_id error, retry with parent_doc_uuid.

query_oscal_documentationA

Search OSCAL documentation (Knowledge Base if configured, plus local docs) and return paged passages. Use when a schema lacks the answer; for a model property try get_oscal_schema. Pass a hit's docId to get_oscal_documentation for the full page.

get_oscal_documentationA

Read an OSCAL documentation page by docId as a verbatim line range. Use when a query_oscal_documentation snippet is not enough. A response may hold fewer lines to fit the response budget; continue from end-line + 1 while has-more is true.

aboutA

Return server metadata: package version, keywords, bundled OSCAL version, and the number of documents loaded from OSCAL_DOCUMENTS_DIR.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

TDQS

A3.6/5.0

Scored across 46 tools

Disambiguation4/5

Tools generally follow clear model/action families, and descriptions explain the intended list-for-selection vs query-for-details workflow. A few parallel names such as list_catalogs/query_catalog and list_component_definitions/list_components could still invite misselection, but they are mostly distinguishable.

Naming Consistency3/5

Most names are snake_case and verb-first, but the surface mixes list_, query_, get_, and search_ patterns with some singular/plural mismatches like list_poams vs query_poam. Awkward names like list_assessment_results_results and the unverbed about reduce predictability.

Tool Count2/5

46 tools is heavy for an MCP server and creates a large selection surface. Although OSCAL is broad, many list/query/child tools could be consolidated through generic document and child-retrieval interfaces.

Completeness4/5

The server covers major OSCAL models, child-element navigation, schema and constraint inspection, validation, documentation search, and resource listing. Minor gaps remain around XML validation and write/update operations, but the read-oriented surface is largely complete.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues