OSCAL MCP Server: Install & Setup

Install OSCAL in Claude Code

Claude Code

claude mcp add oscal -- uvx mcp-server-for-oscal

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "oscal": {
      "command": "uvx",
      "args": [
        "mcp-server-for-oscal"
      ]
    }
  }
}

AI agent tools for Open Security Controls Assessment Language (OSCAL)

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

Run: claude mcp add oscal -- uvx mcp-server-for-oscal

semgrep/semgrep/mcp

Scan code for security vulnerabilities using Semgrep.

mrexodia/ida-pro-mcp

IDA Pro plugin for binary analysis: decompilation, disassembly and automatic malware analysis reports.

LaurieWired/GhidraMCP

Autonomous reverse engineering with Ghidra: decompile binaries, rename methods and data, and list methods, classes, imports and exports.

nowork-studio/notfair-plugin

OAuth MCP for Google, Meta, X, LinkedIn, Reddit, TikTok, GSC, GA4, WordPress and GHL.

zinja-coder/jadx-ai-mcp

JADX decompiler plugin providing live, LLM-assisted reverse engineering.

ENTERPILOT/GoModel

Self-hosted gateway aggregating upstream MCP servers behind one authenticated HTTP endpoint.