feat(oscal): emit unmapped findings as-is + MCP oscal_assessment tool #214

2026-07-21T09:33:30Z

sharang commented

2026-07-21 09:33:30 +00:00

What

The OSCAL emitter now reports every finding — mapped or not — and serves it over MCP, per the "no finding lost" rule.

Changes

Emitter (assess) keys off each finding's stamped control_refs (from the scan's control-triage stage), not the old CWE linker. Mapped findings → OSCAL findings targeting their controls; unmapped findings → standalone observations, reported as-is (with cwe/tool/severity props). False positives excluded. Deterministic.
New compliance-mcp tool oscal_assessment — serves the OSCAL assessment-results for a repo's findings. This is the surface breakpilot's scanner_mcp_client pulls.
POST /api/v1/oscal/assess simplified to the new signature.

Principle

Every finding flows to breakpilot in OSCAL — tagged if we can, as-is if we can't. Unmapped findings keep their CWE/rule, so they're re-mappable later as the LUT / master-controls grow (no rescan).

Testing

clippy -D warnings (agent + mcp) + cargo fmt --all --check + CI test cmd (298 + 52 + 4 + 27) green. Emitter tests: mapped→control-finding, unmapped→as-is observation, false-positive→excluded, deterministic OSCAL.

## What The OSCAL emitter now reports **every** finding — mapped or not — and serves it over MCP, per the "no finding lost" rule. ## Changes 1. **Emitter (`assess`)** keys off each finding's stamped `control_refs` (from the scan's control-triage stage), not the old CWE linker. Mapped findings → OSCAL findings targeting their controls; **unmapped findings → standalone observations, reported as-is** (with `cwe`/`tool`/`severity` props). False positives excluded. Deterministic. 2. **New `compliance-mcp` tool `oscal_assessment`** — serves the OSCAL assessment-results for a repo's findings. This is the surface breakpilot's `scanner_mcp_client` pulls. 3. `POST /api/v1/oscal/assess` simplified to the new signature. ## Principle Every finding flows to breakpilot in OSCAL — tagged if we can, as-is if we can't. Unmapped findings keep their CWE/rule, so they're re-mappable later as the LUT / master-controls grow (no rescan). ## Testing `clippy -D warnings` (agent + mcp) + `cargo fmt --all --check` + CI test cmd (**298 + 52 + 4 + 27**) green. Emitter tests: mapped→control-finding, unmapped→as-is observation, false-positive→excluded, deterministic OSCAL.

sharang added 1 commit 2026-07-21 09:33:30 +00:00

feat(oscal): emit unmapped findings as-is + MCP oscal_assessment tool

CI / Check (push) Skipped

CI / Check (pull_request) Successful in 5m50s

Details

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy Docs (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

54cf39383c

The OSCAL emitter now reports EVERY non-false-positive finding: mapped findings
(via their stamped control_refs) target their controls; UNMAPPED findings are
emitted as standalone observations, reported as-is (cwe/tool/severity props) so
nothing is lost — they can be mapped later as the LUT / master-controls grow.
assess() keys off Finding.control_refs now, not the CWE linker.

New compliance-mcp `oscal_assessment` tool serves this OSCAL over MCP — what
breakpilot's scanner_mcp_client pulls. Assess endpoint simplified to match.
Emitter tests cover mapped / unmapped-as-is / false-positive-excluded.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 18a23403a1 into main

2026-07-21 09:48:38 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#214