A question about a control or baseline often sends a security team through several documents and spreadsheets. An AI assistant can speed up that search, but its answer still needs a reliable source and a way to check the relationship it claims. We built Oscalis to give MCP-capable assistants structured, read-only access to OSCAL reference data.
Oscalis includes NIST SP 800-53 Rev 5.2, CSF 2.0, and AI RMF 1.0 catalogs, along with NIST SP 800-53B, FedRAMP Rev 5, and derived GovRAMP Rev 5 baselines. Its tools can search controls, inspect profile membership, compare baselines, and follow mappings with provenance and confidence labels.
An example: moving from Moderate to High
Suppose a team is evaluating what changes when it moves from the NIST SP 800-53B Moderate baseline to High. A useful first question for an MCP-capable assistant is:
Which controls are added or removed between the NIST SP 800-53B Moderate and High baselines, and which parameter values change?
The assistant can call Oscalis’s baseline_delta tool to retrieve those differences. For any control that matters to the decision, it can then call get_control to bring back the control wording and baseline context. The team can review those results against the official publications before making a scope or implementation decision.
This workflow is intentionally narrow: it helps people find and compare source material. It does not decide whether a system satisfies a control or produce an authorization package.
Why the labels matter
Oscalis includes CSF 2.0-to-800-53 references sourced from NIST’s published material. The confidence values added by Oscalis are project heuristics, not NIST scores. Its AI RMF-to-800-53 mappings are analyst-authored examples and are marked as leads rather than compliance evidence. The derived GovRAMP profiles likewise need to be checked against current GovRAMP workbooks.
Keeping these distinctions visible makes the tool more useful in reviewable workflows. A mapping can guide the next question without becoming an unsupported compliance claim.
Explore Oscalis
The server’s seven MCP tools are read-only. It supports local stdio and a separately configured SSE transport; the repository has installation steps, tool details, source notes, and known gaps. Oscalis is an independent Cyversight project, not affiliated with or endorsed by NIST, FedRAMP, or GovRAMP.
If you are planning an OSCAL-backed workflow or need to connect AI architecture with security governance, tell us what you are trying to build.