sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(oscal): emit unmapped findings as-is + MCP oscal_assessment tool #214

Merged
sharang merged 1 commits from feat/oscal-emit-unmapped-mcp into main 2026-07-21 09:48:38 +00:00
Conversation 0 Commits 1 Files Changed 5
+180 -136
1 Commits
Author SHA1 Message Date
Sharang ParnerkarandClaude Fable 5 54cf39383c feat(oscal): emit unmapped findings as-is + MCP oscal_assessment tool
CI / Check (push) Skipped
CI / Check (pull_request) Successful in 5m50s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details 
The OSCAL emitter now reports EVERY non-false-positive finding: mapped findings
(via their stamped control_refs) target their controls; UNMAPPED findings are
emitted as standalone observations, reported as-is (cwe/tool/severity props) so
nothing is lost — they can be mapped later as the LUT / master-controls grow.
assess() keys off Finding.control_refs now, not the CWE linker.

New compliance-mcp `oscal_assessment` tool serves this OSCAL over MCP — what
breakpilot's scanner_mcp_client pulls. Assess endpoint simplified to match.
Emitter tests cover mapped / unmapped-as-is / false-positive-excluded.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-21 11:33:09 +02:00