Is io.github.awslabs/mcp-server-for-oscal safe to use?

io.github.awslabs/mcp-server-for-oscal has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.awslabs/mcp-server-for-oscal?

io.github.awslabs/mcp-server-for-oscal supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.awslabs/mcp-server-for-oscal do?

io.github.awslabs/mcp-server-for-oscal provides 3 tools: list_oscal_models, get_oscal_schema, list_oscal_resources. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.awslabs/mcp-server-for-oscal?

io.github.awslabs/mcp-server-for-oscal is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.awslabs/mcp-server-for-oscal actively maintained?

io.github.awslabs/mcp-server-for-oscal is actively maintained — last commit was 10 days ago. It has 43 GitHub stars.

io.github.awslabs/mcp-server-for-oscal

AI agent tools for Open Security Controls Assessment Language (OSCAL)

43 3 tools GitHub

No known CVEs

No license

Actively maintained

Last commit 10d ago

Works with most clients

Transport: stdio, sse, http

3 tools · ~198 tok

Grade A · 0.1% of 200K ctx

Edit this pageView history

Security Legal

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "oscal": {
      "args": [
        "mcp-server-for-oscal@latest"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-awslabs-mcp-server-for-oscal)](https://mcppedia.org/s/io-github-awslabs-mcp-server-for-oscal)

Read me

What io.github.awslabs/mcp-server-for-oscal does

[pypi-badge]: https://img.shields.io/pypi/v/mcp-server-for-oscal.svg [pypi-url]: https://pypi.org/project/mcp-server-for-oscal/ [nist-oscal-url]: https://pages.nist.gov/OSCAL/ [mcp-spec-url]: https://modelcontextprotocol.io/docs/getting-started/intro [issues-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/ [new-issue-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/new

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

70/100across 5 weighted dimensions

How we score →

0255075100

−30

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Inventory

Tools (3)

Click any tool to inspect its schema.

~198 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.awslabs/mcp-server-for-oscal safe to use?: io.github.awslabs/mcp-server-for-oscal has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.awslabs/mcp-server-for-oscal?: io.github.awslabs/mcp-server-for-oscal supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.awslabs/mcp-server-for-oscal do?: io.github.awslabs/mcp-server-for-oscal provides 3 tools: list_oscal_models, get_oscal_schema, list_oscal_resources. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.awslabs/mcp-server-for-oscal?: io.github.awslabs/mcp-server-for-oscal is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.awslabs/mcp-server-for-oscal actively maintained?: io.github.awslabs/mcp-server-for-oscal is actively maintained — last commit was 10 days ago. It has 43 GitHub stars.

Similar servers

Others in security / legal

View all →

Korean Law Mcp95

87 tools for Korean law — statutes, precedents, ordinances, interpretations | MCP Server · CLI · npm

1.9k 7

Evil Mcp Server93

An evil MCP server used for redteam testing

30 1

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

9.0k 3

MCP Security Weekly

Get CVE alerts and security updates for io.github.awslabs/mcp-server-for-oscal and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Security Legal

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "oscal": {
      "args": [
        "mcp-server-for-oscal@latest"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-awslabs-mcp-server-for-oscal)](https://mcppedia.org/s/io-github-awslabs-mcp-server-for-oscal)

Read me

What io.github.awslabs/mcp-server-for-oscal does

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

MCP Server for OSCAL

Instant OSCAL expertise for your favorite AI agent

A Model Context Protocol (MCP) server that provides AI assistants (Claude, Cline, Kiro, Claude Code, etc.) with tools to work with NIST's Open Security Controls Assessment Language (OSCAL). Like many early adopters, we needed help implementing OSCAL proofs-of-concept to demonstrate value to business stakeholders. Perhaps due to limited availability of examples in the public domain, we found that most AI agents/LLMs alone produced inconsistent results related to OSCAL. The tools in this MCP server minimized that problem for our use-case and we hope it does the same for you.

[!TIP] To get started, see Installation below.

Features

Together, the tools provided by this MCP server are meant to enable your preferred AI assistant to provide accurate, authoritative guidance about OSCAL architecture, models, use-cases, requirements, and implementation. You don't need to understand the tools to use them, but details are in the tools directory.

The server is lightweight and meant to run locally without additional setup. By default, it uses stdio protocol for MCP transport. Do not attempt to use the server with streamable-http transport, as we've not yet implemented transport security or authentication.

The default tools should not connect to any remote services or resources - all required content is bundled with the server. As a security measure, we've implemented basic file integrity verification for bundled content. At build-time we generate manifests including SHA-256 hashes of all content files. Each time the server starts, all content files are verified against the hash manifests. Any mismatch should produce an error and prevent startup.

In addition to the MCP server, the package includes a standalone OSCAL agent built with Strands Agents. See the OSCAL Agent section below.

What is OSCAL?

OSCAL (Open Security Controls Assessment Language) is a set of framework-agnostic, vendor-neutral, machine-readable schemas developed by NIST that describe the full life cycle of GRC (governance, risk, compliance) artifacts, from controls to remediation plans. OSCAL enables automation of GRC workflows by replacing digital paper (spreadsheets, PDFs, etc.) with a standard-based structured data format. To learn more about OSCAL, install this MCP server then ask your AI. Or see the official OSCAL website.

What is MCP?

MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems. Think of MCP like a USB-C port for AI app

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

70/100across 5 weighted dimensions

How we score →

0255075100

−30

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Inventory

Tools (3)

Click any tool to inspect its schema.

~198 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.awslabs/mcp-server-for-oscal safe to use?: io.github.awslabs/mcp-server-for-oscal has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.awslabs/mcp-server-for-oscal?: io.github.awslabs/mcp-server-for-oscal supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.awslabs/mcp-server-for-oscal do?: io.github.awslabs/mcp-server-for-oscal provides 3 tools: list_oscal_models, get_oscal_schema, list_oscal_resources. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.awslabs/mcp-server-for-oscal?: io.github.awslabs/mcp-server-for-oscal is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.awslabs/mcp-server-for-oscal actively maintained?: io.github.awslabs/mcp-server-for-oscal is actively maintained — last commit was 10 days ago. It has 43 GitHub stars.

Similar servers

Others in security / legal

View all →

Korean Law Mcp95

87 tools for Korean law — statutes, precedents, ordinances, interpretations | MCP Server · CLI · npm

1.9k 7

Evil Mcp Server93

An evil MCP server used for redteam testing

30 1

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

9.0k 3

MCP Security Weekly

Get CVE alerts and security updates for io.github.awslabs/mcp-server-for-oscal and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?