Find controls with context
Search NIST SP 800-53 Rev 5.2, CSF 2.0, and AI RMF 1.0 catalogs; retrieve individual controls and their source text.
Oscalis · Built by Cyversight
Make security frameworks usable in AI workflows.
Oscalis is an open-source MCP server that gives AI assistants read-only access to NIST OSCAL controls, program baselines, and source-aware framework mappings.
What it helps you do
Move from a framework question to the source.
Give an MCP-capable assistant a structured way to look up controls, inspect profile membership, and compare baselines. Use the results to support research and review—not as a substitute for an assessment.
Compare baselines
Inspect NIST SP 800-53B, FedRAMP Rev 5, and derived GovRAMP Rev 5 profiles. See added or removed controls and changed parameter values.
Trace mappings
Explore CSF-to-800-53 references with provenance and project confidence labels. Experimental AI RMF mappings are clearly identified.
Example workflow
Compare before you decide.
Ask an MCP-capable assistant which controls change between the NIST SP 800-53B Moderate and High baselines. Oscalis can return the delta, then retrieve the source text for controls you want to examine.
- Compare selected controls and parameter values.
- Open individual controls for the underlying wording.
- Review the result against official publications before using it in a decision.
Use it responsibly
Reference data, not a compliance verdict.
Oscalis is useful for security leaders, GRC teams, and developers building AI-assisted control research. The project is independent of NIST, FedRAMP, and GovRAMP and is not endorsed by them.
Get started
Explore the code. Then put it to work.
The repository has the install steps, tool reference, and source notes. If you are considering OSCAL or AI-assisted governance in your organization, Cyversight can help design the workflow around your actual requirements.