MCP server for TheArtOfService Compliance Intelligence — 692+ frameworks, 14,200+ controls, 819K+ cross-framework mappings
SaferSkills independently audited Compliance Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This repository contains the source of an MCP (Model Context Protocol) server implementation, under npm/. It speaks MCP over stdio to any MCP client and is published as @theartofservice/compliance-mcp.
Alongside it, python/ holds a LangChain toolkit for the same API. That one is not an MCP server, it is an SDK, and it is here because it targets the same graph.
The server exposes a compliance knowledge graph of 686 frameworks, 21,696+ controls and 300K+ cross-framework mappings, where a mapping records what one standard already evidences of another, along with the reasoning and the rejections.
| what it is | source | published as | |
|---|---|---|---|
| Node | MCP server, stdio | npm/src/index.js | @theartofservice/compliance-mcp |
| Python | LangChain toolkit, not MCP | python/src/theartofservice_compliance/ | theartofservice-compliance |
The Node implementation is built on the official @modelcontextprotocol/sdk, registering its tools through Server and serving them over StdioServerTransport.
| tool | what it answers |
|---|---|
search_frameworks | find a standard by name or subject |
get_framework | one framework in full, with its domains |
get_framework_controls | the control set of a framework |
search_controls | find controls by text across the graph |
cross_framework_map | what standard A already evidences of standard B |
coverage_report | how much of a target standard a source covers |
npx -y @theartofservice/compliance-mcpTools list without a key, so any client can inspect the server. Calling one needs THEARTOFSERVICE_API_KEY. If you would rather not sign up for anything, the hosted endpoint below serves the same graph anonymously.
Claude Desktop, Claude Code, Cursor, Windsurf and any other MCP client can launch either one directly. Add to your client config:
{
"mcpServers": {
"compliance": {
"command": "npx",
"args": ["-y", "@theartofservice/compliance-mcp"]
}
}
}If you would rather not run anything, the same server is hosted:
https://api.theartofservice.com/mcpStreamable HTTP, anonymous access. It is listed in the official MCP registry as com.theartofservice/compliance-intelligence.
The figures above are read from the live graph. They move, so treat them as a floor rather than a fixed number, and read the current values from:
https://api.theartofservice.com/api/agent/statsMIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.