MCP Server for OSCAL
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OSCAL_DOCUMENTS_DIR | No | Directory containing your OSCAL JSON files. Not scanned when empty. | |
| OSCAL_STORE_DB_PATH | No | Path to a persistent SQLite database. When set, the index is reused across server restarts instead of being rebuilt each time. | |
| OSCAL_STORE_CACHE_SIZE | No | Maximum number of parsed OSCAL documents to keep in the in-memory LRU cache. | 100 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_oscal_modelsA | List the OSCAL model names, each with description, layer, formal and short names, and release status. Use when you need a valid |
| get_oscal_schemaA | Return the JSON schema or XML Schema (XSD) of one OSCAL model as text. Use when you need the structure of an OSCAL model: its properties, types, and required fields. |
| get_allowed_valuesA | Return the values OSCAL Metaschema |
| get_constraintsA | List the OSCAL Metaschema constraints at a target ( |
| find_references_toA | Find the fields, flags, props, and links that OSCAL Metaschema |
| get_definitionA | Return every OSCAL Metaschema definition with a given name, with formal name,
description, remarks, flags, model children, constraint summaries, and source file and
line. Use when you need documentation or structure that the generated JSON and XML schemas
shorten or drop. Results are paged within a response budget, and long remarks are marked
|
| get_metaschema_sourceA | Read a line range of a bundled OSCAL Metaschema source file verbatim, or list the files
with line counts when |
| list_oscal_resourcesA | List OSCAL community resources (tools, content, articles, talks) from the awesome-oscal
list, each with |
| query_component_definitionA | Return OSCAL Components from loaded Component Definitions as OSCAL JSON, or one Capability when a by_uuid or by_title query matches a Capability. Use when you need component details: call it directly with by_title or by_type when you know the name or type, else find UUIDs and titles first with list_components; use list_capabilities or get_capability only for Component Definitions that contain capabilities. Results are paged. |
| list_component_definitionsA | List loaded Component Definitions with UUID, title, component count, and size. Use when
picking a |
| list_componentsA | List loaded Components with UUID, title, and parent Component Definition. Use when
picking a |
| list_capabilitiesA | List loaded Capabilities with UUID, name, and parent Component Definition. Use when working with Component Definitions that contain capabilities; the list is empty when none do. Results are paged. |
| get_capabilityA | Get one Capability by UUID as OSCAL JSON, or null when no Capability has that UUID. Use when working with Component Definitions that contain capabilities. |
| validate_oscal_contentA | Validate OSCAL JSON text and return per-level results for JSON syntax, JSON Schema, the OSCAL model, and oscal-cli (skipped when not installed). Later levels are skipped when the JSON does not parse. |
| validate_oscal_fileA | Validate an OSCAL JSON file and return per-level results for JSON syntax, JSON Schema, the OSCAL model, and oscal-cli (skipped when not installed). Use when the document is in a file; for JSON text use validate_oscal_content. |
| query_catalogA | Return loaded OSCAL Catalogs with metadata and |
| list_catalogsA | List loaded OSCAL Catalogs with UUID, title, child count, and size. Use when picking a
|
| query_sspA | Return loaded OSCAL SSPs with metadata and |
| list_sspsA | List loaded OSCAL System Security Plans with UUID, title, child count, and size. Use when
picking a |
| query_profileA | Return loaded OSCAL Profiles with metadata and |
| list_profilesA | List loaded OSCAL Profiles with UUID, title, child count, and size. Use when picking a
|
| query_assessment_planA | Return loaded OSCAL Assessment Plans with |
| list_assessment_plansA | List loaded OSCAL Assessment Plans with UUID, title, child count, and size. Use when
picking a |
| query_assessment_resultsA | Return loaded OSCAL Assessment Results with |
| list_assessment_resultsA | List loaded OSCAL Assessment Results with UUID, title, child count, and size. Use when
picking a |
| query_poamA | Return loaded OSCAL Plans of Action and Milestones with metadata and |
| list_poamsA | List loaded OSCAL Plans of Action and Milestones with UUID, title, child count, and size.
Use when picking a |
| query_mapping_collectionB | Return loaded OSCAL Mapping Collections with metadata and |
| list_mapping_collectionsA | List loaded OSCAL Mapping Collections with UUID, title, child count, and size. Use when
picking a |
| text_search_oscalA | Search loaded OSCAL documents and child elements, including control prose, ranked by
relevance. Pass a child hit's entity ID and |
| list_catalog_controlsA | List controls in loaded OSCAL Catalogs with token ID (e.g. ac-1), title, and parent document. Get a control's OSCAL JSON with get_child_element. Results are paged. |
| list_catalog_groupsB | List control groups (families) in loaded OSCAL Catalogs with token ID, title, and parent document. Get a group's OSCAL JSON with get_child_element. Results are paged. |
| list_ssp_control_implementationsA | List the control-implementation element of loaded OSCAL SSPs, one per SSP. Get its OSCAL JSON with get_child_element. Results are paged. |
| list_ssp_system_componentsA | List system components in loaded OSCAL SSPs with UUID, title, and parent document. Get a component's OSCAL JSON with get_child_element. Results are paged. |
| list_profile_importsA | List imports in loaded OSCAL Profiles, with positional IDs (import-0, import-1). Get an import's OSCAL JSON with get_child_element. Results are paged. |
| list_profile_modifyB | List the modify element (control tailoring) of loaded OSCAL Profiles, one per profile. Get its OSCAL JSON with get_child_element. Results are paged. |
| list_assessment_plan_tasksA | List tasks in loaded OSCAL Assessment Plans with UUID, title, and parent document. Get a task's OSCAL JSON with get_child_element. Results are paged. |
| list_assessment_plan_activitiesA | List activities in loaded OSCAL Assessment Plans with UUID, title, and parent document. Get an activity's OSCAL JSON with get_child_element. Results are paged. |
| list_assessment_results_resultsA | List results in loaded OSCAL Assessment Results with UUID, title, and parent document. Get a result's OSCAL JSON with get_child_element. Results are paged. |
| list_assessment_results_findingsA | List findings in loaded OSCAL Assessment Results with UUID, title, and parent document. Get a finding's OSCAL JSON with get_child_element. Results are paged. |
| list_poam_itemsA | List POA&M items in loaded OSCAL POA&Ms with ID, title, and parent document. Get an item's OSCAL JSON with get_child_element. Results are paged. |
| list_mapping_collection_mappingsA | List mappings in loaded OSCAL Mapping Collections with UUID, title, and parent document. Get a mapping's OSCAL JSON with get_child_element. Results are paged. |
| get_child_elementA | Get one child element by UUID or token ID, with its OSCAL JSON in |
| query_oscal_documentationA | Search OSCAL documentation (Knowledge Base if configured, plus local docs) and return
paged passages. Use when a schema lacks the answer; for a model property try
get_oscal_schema. Pass a hit's |
| get_oscal_documentationA | Read an OSCAL documentation page by |
| aboutA | Return server metadata: package version, keywords, bundled OSCAL version, and the number of documents loaded from OSCAL_DOCUMENTS_DIR. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 46 tools
Tools generally follow clear model/action families, and descriptions explain the intended list-for-selection vs query-for-details workflow. A few parallel names such as list_catalogs/query_catalog and list_component_definitions/list_components could still invite misselection, but they are mostly distinguishable.
Most names are snake_case and verb-first, but the surface mixes list_, query_, get_, and search_ patterns with some singular/plural mismatches like list_poams vs query_poam. Awkward names like list_assessment_results_results and the unverbed about reduce predictability.
46 tools is heavy for an MCP server and creates a large selection surface. Although OSCAL is broad, many list/query/child tools could be consolidated through generic document and child-retrieval interfaces.
The server covers major OSCAL models, child-element navigation, schema and constraint inspection, validation, documentation search, and resource listing. Minor gaps remain around XML validation and write/update operations, but the read-oriented surface is largely complete.