MCP Server For OSCAL
Query and work with Open Security Controls Assessment Language (OSCAL) content from an agent using AWS Bedrock and a dedicated OSCAL knowledge base.
Overview
MCP Server for OSCAL is a MCP server for the Ship phase that exposes OSCAL-focused agent tools backed by AWS Bedrock and an OSCAL knowledge base.
What is this MCP server?
- MCP Server for OSCAL v0.4.0 (awslabs) with stdio transport via PyPI `mcp-server-for-oscal`
- Bedrock-backed documentation queries using BEDROCK_MODEL_ID and OSCAL_KB_ID
- AWS credential wiring through AWS_PROFILE and AWS_REGION environment variables
- Configurable LOG_LEVEL (DEBUG, INFO, WARNING, ERROR) for operational troubleshooting
- Package and server version 0.4.0
- Five documented environment variables: BEDROCK_MODEL_ID, OSCAL_KB_ID, AWS_PROFILE, AWS_REGION, LOG_LEVEL
- Repository: github.com/awslabs/mcp-server-for-oscal
What problem does it solve?
Mapping product behavior to formal control frameworks in OSCAL format is slow and error-prone without agent-accessible, KB-grounded tooling.
Who is it for?
Builders shipping B2B or regulated-adjacent SaaS who already use AWS and want agent help navigating OSCAL catalogs and assessments.
Skip if: Hobby projects with no compliance requirements, teams without AWS Bedrock access, or orgs that forbid LLM-generated control interpretations as audit evidence.
What do I get? / Deliverables
Once configured, your agent can query OSCAL documentation and support compliance-oriented tasks using your Bedrock model and OSCAL_KB_ID.
- Agent-callable OSCAL documentation and workflow tools via MCP
- Bedrock-grounded answers tied to your configured OSCAL knowledge base
- Environment-tuned logging for compliance integration debugging
Recommended MCP Servers
Journey fit
How it compares
OSCAL-focused Bedrock MCP server—not a generic vulnerability scanner or AWS deployment skill.
Common Questions / FAQ
Who is MCP Server For OSCAL for?
Solo builders and small teams accountable for security compliance who work in AWS and need OSCAL-aware agent assistance.
When should I use MCP Server For OSCAL?
Use it during security and launch prep when you are aligning controls, assessments, or documentation with OSCAL and want grounded Q&A via Bedrock.
How do I add MCP Server For OSCAL to my agent?
Install `mcp-server-for-oscal` from PyPI as a stdio MCP server and set BEDROCK_MODEL_ID, OSCAL_KB_ID, AWS_PROFILE, AWS_REGION, and optional LOG_LEVEL in the server environment.