LocalFree

OSCAL MCP server

dfkunstler/mcp-server-for-oscal

AI agent tools for Open Security Controls Assessment Language (OSCAL)

Source code

Install OSCAL in Claude Code

Claude Code
claude mcp add dfkunstler-oscal -- uvx mcp-server-for-oscal
mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)
{
  "mcpServers": {
    "dfkunstler-oscal": {
      "command": "uvx",
      "args": [
        "mcp-server-for-oscal"
      ]
    }
  }
}

Frequently asked questions

What does the OSCAL MCP server do?

AI agent tools for Open Security Controls Assessment Language (OSCAL)

Is the OSCAL MCP server free?

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Does OSCAL run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add OSCAL to Claude Code?

Run: claude mcp add dfkunstler-oscal -- uvx mcp-server-for-oscal

More security & identity MCP servers

View all

Semgrep

17k

semgrep/semgrep/mcp

Scan code for security vulnerabilities using Semgrep.

LocalAccount neededPython

IDA Pro

13k

mrexodia/ida-pro-mcp

IDA Pro plugin for binary analysis: decompilation, disassembly and automatic malware analysis reports.

LocalFreePython

GhidraMCP

12k

LaurieWired/GhidraMCP

Autonomous reverse engineering with Ghidra: decompile binaries, rename methods and data, and list methods, classes, imports and exports.

LocalFreeJava

NotFair

4.1k

nowork-studio/notfair-plugin

OAuth MCP for Google, Meta, X, LinkedIn, Reddit, TikTok, GSC, GA4, WordPress and GHL.

RemoteAccount needed

Jadx AI

3k

zinja-coder/jadx-ai-mcp

JADX decompiler plugin providing live, LLM-assisted reverse engineering.

LocalFreeJava

GoModel

1.3k

ENTERPILOT/GoModel

Self-hosted gateway aggregating upstream MCP servers behind one authenticated HTTP endpoint.

LocalFree