Server for OSCAL MCP Server

[pypi-url]: https://pypi.org/project/mcp-server-for-oscal/ [nist-oscal-url]: https://pages.nist.gov/OSCAL/ [mcp-spec-url]: https://modelcontextprotocol.io/docs/getting-started/intro [issues-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/ [new-issue-url]: https://github.com/awslabs/mcp-server-for-oscal/issues/new. It runs locally over stdio via the published package.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-06-23 · ★ 52 · #63 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

Apache-2.0 · Python servers · how we verify → /methodology

01 · Install Server for OSCAL

before you install - you'll need

Set OSCAL_DOCUMENTS_DIR before connecting.

Claude Code

claude mcp add awslabs-mcp-server-for-oscal -- uvx mcp-server-for-oscal

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "awslabs-mcp-server-for-oscal": {
      "command": "uvx",
      "args": [
        "mcp-server-for-oscal"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

pypi package mcp-server-for-oscal - check the name against the project README before installing (PyPI has no namespace ownership)

registry namespace io.github.awslabs is GitHub-verified and matches the repo owner

03 · What Server for OSCAL can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.4.0 · 2026-04-02

OSCAL Content Index (OscalStore) · -- FTS5 full-text search across all indexed OSCAL documents · -- LRU caching for parsed Trestle models · -- Change detection via SHA-256 content hashing · -- Three database modes…

v0.3.3 · 2026-03-23

feat(#89) refactor oscal strands agent and wire up for standalone use @dfkunstler in and

v0.3.2 · 2026-03-20

CI bug-fix only; see release notes for v0.3.1 for details

04 · Who maintains Server for OSCAL

MCP Server for OSCAL is maintained by awslabs. It's the only MCP server we track from this author; the repo dates to Dec 2025.

05 · Facts

repository: github.com/awslabs/mcp-server-for-oscal
category: security - ranked #63 of 182 actively-maintained security servers as of 2026-08-25.
registry: io.github.awslabs/mcp-server-for-oscal (active, first published 2026-03-20 · 3 versions)
packages: pypi:mcp-server-for-oscal

06 · Server for OSCAL FAQ

What is Server for OSCAL?

Is Server for OSCAL still maintained?

Yes - as of 2026-08-25, its last commit was 2026-06-23. We re-verify nightly.

How do I install Server for OSCAL?

Run `uvx mcp-server-for-oscal`. The README documents one environment variable (OSCAL_DOCUMENTS_DIR) to set first. Set OSCAL_DOCUMENTS_DIR before connecting. You can also paste the ready-made client config above.

Does Server for OSCAL run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Server for OSCAL

Alternatives to Server for OSCAL

Maintained security servers if Server for OSCAL isn't the fit.

Pairs well with

Servers that cover what Server for OSCAL doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · A X · Aikido MCP · Bawbel Scanner · Mcpwall · FAOSTAT MCP

More Python MCP servers · Türk Hukuku İçtihat · Python Docs MCP Server · Ayn Ops · Yapitalism · Safeagent · see all