Extensive feature doc for the compliance control-mapping engine:
- core principle (tools detect, LLM judges/grounds — never detects)
- coverage model + the CRA hybrid (4 semgrep / 8 grounded / 4 not-code-checkable)
- the three mapping paths (LUT 5b / semantic 5c / grounded-surface 5d) with a
mermaid flow, and the shared grounding gate
- semantic retrieval detail incl. the query-enrichment tuning
- two worked examples from the live C5 run (auth file + varied vulns)
- known limitations (absence findings, catch-all controls, corpus noise)
- config flags + an appendix on the master-controls data pipeline war-story
(dump-triplication -> migration 160 dedup; 502 -> 200)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New `compliance-mcp` crate providing a Model Context Protocol server
with 7 tools: list/get/summarize findings, list SBOM packages, SBOM
vulnerability report, list DAST findings, and DAST scan summary.
Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT).
Includes Dockerfile, CI clippy check, and Coolify deploy job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #5
sharang