Server for OSCAL MCP Server

[pypi-url]: https://pypi.org/project/mcp-server-for-oscal/ [nist-oscal-url]: https://pages.nist.gov/OSCAL/ [mcp-spec-url]: https://modelcontextprotocol.io/docs/getting-started/intro [issues-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/ [new-issue-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/new. It runs locally over stdio via the published package.

People who work with oscal, strands agents and compliance as code and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

NO LONGER MAINTAINED

LAST COMMIT 2026-06-23 · ★ 53 · VERIFIED 2026-09-18

Apache-2.0 · Python servers · how we verify → /methodology

01 · Install Server for OSCAL

before you install - you'll need

Set OSCAL_DOCUMENTS_DIR before connecting.

Claude Code

claude mcp add awslabs-mcp-server-for-oscal -- uvx mcp-server-for-oscal

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "awslabs-mcp-server-for-oscal": {
      "command": "uvx",
      "args": [
        "mcp-server-for-oscal"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

repository archived on GitHub - read-only; no future fixes, security or otherwise

license Apache-2.0 - declared in the repository

pypi package mcp-server-for-oscal - check the name against the project README before installing (PyPI has no namespace ownership)

registry namespace io.github.awslabs is GitHub-verified and matches the repo owner

03 · What Server for OSCAL can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.4.0 · 2026-04-02

OSCAL Content Index (OscalStore) · -- FTS5 full-text search across all indexed OSCAL documents · -- LRU caching for parsed Trestle models · -- Change detection via SHA-256 content hashing · -- Three database modes…

v0.3.3 · 2026-03-23

feat(#89) refactor oscal strands agent and wire up for standalone use @dfkunstler in and

v0.3.2 · 2026-03-20

CI bug-fix only; see release notes for v0.3.1 for details

04 · Who maintains Server for OSCAL

MCP Server for OSCAL is maintained by awslabs. It's the only MCP server we track from this author; the repo dates to Dec 2025.

05 · Facts

repository: github.com/awslabs/mcp-server-for-oscal
category: security - dead as of 2026-09-18.
registry: io.github.awslabs/mcp-server-for-oscal (active, first published 2026-03-20 · 3 versions)
packages: pypi:mcp-server-for-oscal

06 · Server for OSCAL FAQ

What is Server for OSCAL?

Is Server for OSCAL still maintained?

Its last commit was 2026-06-23 (as of 2026-09-18) - we classify it as dead.

How do I install Server for OSCAL?

Run `uvx mcp-server-for-oscal`. The README documents one environment variable (OSCAL_DOCUMENTS_DIR) to set first. Set OSCAL_DOCUMENTS_DIR before connecting. You can also paste the ready-made client config above.

Does Server for OSCAL run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Server for OSCAL

Alternatives to Server for OSCAL

Maintained security servers if Server for OSCAL isn't the fit.

Pairs well with

Servers that cover what Server for OSCAL doesn't - only shown when the pairing reason fits the companion.