MCP Server for OSCAL

Overview

MCP Server for OSCAL brings AI agent tools for Open Security Controls Assessment Language (OSCAL) to any MCP client. Instead of manual copy-paste workflows, AI assistants can call OSCAL tools directly as part of their reasoning process, letting you automate compliance and security assessments through natural conversation.

The server runs locally on your machine via the Python package mcp-server-for-oscal, installed with uvx mcp-server-for-oscal. It communicates over stdio and requires no authentication—it works immediately after installation. Version v0.4.0 is released under the Apache-2.0 license with source code at awslabs/mcp-server-for-oscal on GitHub, where the project has earned 53 stars.

MCP Server for OSCAL is listed in the Security category on mcp.site and works with any MCP client including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Zed. If you maintain this server for awslabs, you can claim this listing to verify ownership and keep information up to date.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "mcp_server_for_oscal": {
      "command": "uvx",
      "args": [
        "mcp-server-for-oscal"
      ]
    }
  }
}