Skip to main content
Glama
oscal-compass

Trestle MCP

Official

Trestle MCP

MCP server to easily use compliance-trestle (OSCAL tool) from Claude, Roo, or any MCP-compliant client.

mcp-name: io.github.oscal-compass/compliance-trestle-mcp

Getting Started

This project can be used in the following two ways:

Choose the option that best fits your workflow.

Related MCP server: MCP REST API Server

Usage from RooCode

  1. Add the following JSON to .roo/mcp.json (Roo workspace):

    {
        "mcpServers": {
            "trestle": {
                "command": "uvx",
                "args": ["--from", "compliance-trestle-mcp", "trestle-mcp"]
            }
        }
    }
  2. Open Roo, confirm trestle tools are listed in the MCP panel, and execute as needed.

    https://github.com/user-attachments/assets/59215549-cad9-4101-baa4-ecba77ac3904


Usage from CLI (MCP Client)

Step 1: Write your mcp.json config

{
    "mcpServers": {
        "trestle": {
            "command": "uvx",
            "args": ["--from", "./trestle-mcp-tmp", "trestle-mcp"]
        }
    }
}

Save this as mcp.json in your current directory.

Step 2: List Available Tools

uvx mcp-cli tools --config-file mcp.json

Sample output (tools available):

6 Available Tools
┌─────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────────────┐
│ Server  │ Tool                            │ Description                                                       │
├─────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────────────┤
│ trestle │ trestle_init                    │ Initialize a trestle working directory.                           │
│ trestle │ trestle_import                  │ Import an existing OSCAL model into the trestle workspace.        │
│ trestle │ trestle_author_catalog_generate │ Generate Catalog controls in markdown form from a catalog         │
│ trestle │ trestle_author_profile_generate │ Generate markdown documentation set for controls defined in profile│
│ trestle │ trestle_author_profile_resolve  │ Resolve an OSCAL profile to a resolved profile catalog.           │
│ trestle │ trestle_author_profile_assemble │ Assemble markdown controls into a Profile JSON file.              │
└─────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────────────┘

Step 3: Execute a Tool (e.g., trestle_init)

Start MCP interactive shell:

uvx mcp-cli interactive --config-file mcp.json

Then run, for example:

> execute trestle_init '{"params": {}}'

Typical result:

✓ ✅ Tool executed successfully
{
  "result": {
    ...
    "content": [
      {
        "type": "text",
        "text": "✅ Trestle workspace initialized successfully"
      }
    ]
  }
}

You'll see folders as follows:

assessment-plans    catalogs               plan-of-action-and-milestones  system-security-plans
assessment-results  component-definitions  profiles

Tool List & Quick Reference

  • trestle_init: Initialize a trestle workspace

  • trestle_import: Import OSCAL models (Catalog/Profile/etc.) from a file or URL

  • trestle_author_catalog_generate: Generate markdown controls from a catalog

  • trestle_author_profile_generate: Generate markdown for profiles

  • trestle_author_profile_resolve: Resolve profile to catalog

  • trestle_author_profile_assemble: Assemble markdown controls into profile JSON

  • trestle_task_csv_to_oscal_cd: Convert a CSV mapping file into an OSCAL component definition

  • trestle_task_xlsx_to_oscal_poam: Convert a FedRAMP-format XLSX spreadsheet into an OSCAL Plan of Action and Milestones (POA&M)

  • trestle_validate: Validate a standalone OSCAL file (any top-level model, e.g. POA&M) against the OSCAL schema (and trestle's semantic checks)

For advanced use, refer to official compliance-trestle docs or developer documents in this repo.

Troubleshooting & Help

  • Make sure uvx is installed and on your PATH.

  • If you see command/module errors, check the MCP server path in mcp.json is correct.


We are a Cloud Native Computing Foundation sandbox project.

The Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see Trademark Usage.

OSCAL Compass is an independent open source project. It is not affiliated with, endorsed by, or sponsored by the National Institute of Standards and Technology (NIST) or any other government agency.

OSCAL Compass was originally contributed by IBM.

Available Tools

9 tools
trestle_author_catalog_generateGenerate Catalog Markdown ControlsA

Generate Catalog controls in markdown form from a catalog in the trestle workspace.

Args: params (TrestleCatalogGenerateInput): Input parameters with: - name (str): Catalog model name (required) - output (str): Output markdown folder (required) - force_overwrite (bool): Force overwrite markdowns (optional) - yaml_header (Optional[str]): Path to yaml header file (optional) - overwrite_header_values (bool): Overwrite markdown header values (optional) - trestle_root (Optional[str]): Trestle workspace root path (optional) - verbose (bool): Display verbose output (optional)

Returns: str: Success or error message

Examples: - Use when: "Generate markdown controls from a catalog" - Use when: "Split a catalog JSON into control-wise markdowns" - Don't use when: "Catalog is missing or output directory already exists and not overwritten"

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool writes markdown files and can overwrite them via force_overwrite. This aligns with annotations (non-read-only, non-destructive, but overwrite is noted). No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively long with code blocks and redundant parameter listings. It could be more concise by omitting the duplicate parameter details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (7 parameters, nested object), the description covers the main functionality, parameters, return, and usage examples. It does not explain the output schema but that is not required. It is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all parameters, and the description's 'Args' section largely duplicates that information without adding significant new meaning. The descriptions are similar, so minimal added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates catalog controls in markdown form, with a specific verb and resource. Sibling tools are all different (profile operations, import, init), so no confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit 'Use when' and 'Don't use when' examples, providing clear usage contexts. However, it does not directly reference sibling tools as alternatives, so it is not perfect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_author_profile_assembleAssemble Profile JSON from Markdown DirectoryA

Assemble markdown controls into a Profile JSON file.

This tool assembles an OSCAL profile JSON (profile.json) from a directory of markdown controls for a profile.

Args: params (TrestleAuthorProfileAssembleInput): - markdown_dir (str): Markdown controls directory (required) - output_profile (str): Output profile directory name (required) - name (Optional[str]): Profile model name - set_parameters (bool): Expand parameters from YAML frontmatter - regenerate (bool): Force UUID regeneration - version (Optional[str]): Model version - sections (Optional[str]): Section info (short:long, comma-separated) - required_sections (Optional[str]): Required section short names, comma-separated - allowed_sections (Optional[str]): Allowed section short names, comma-separated - verbose (bool): Verbose output - trestle_root (Optional[str]): Path of trestle root directory

Returns: str: Success message with stdout, or error message with stderr details

Examples: - Use when: Automatically assemble OSCAL profile from markdown directory - Use when: CI/CD profile assembling, parameter expansion - Don't use when: Input markdown_dir does not exist, or malformed markdown

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=false (writes), destructiveHint=false (non-destructive), and idempotentHint=false. The description adds that the tool writes a profile.json file and returns a success/error string. While it doesn't detail permissions or exact side effects, it aligns with annotations and provides basic behavioral context. The openWorldHint=true suggests no external dependencies are hidden, but the description lacks explicit statements about file system impact or required environment setup.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with headings (purpose, args, returns, examples) and bullet points, making it easy to scan. It front-loads the core purpose. However, it is somewhat verbose; the 'Args' section could be more concise since the schema already describes parameters. The examples are helpful but repeated phrases ('Use when') could be trimmed. Overall, it is efficient for a complex tool with many parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, all parameters with descriptions, return value, and usage examples including contraindications. It does not explain the output file structure (e.g., profile.json contents) beyond being a JSON, but the output schema is marked as present. Given the complexity (1 complex param with many sub-params), the description is complete enough for an agent to invoke correctly. Missing details like required trestle root setup or dependency on trestle_init are minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although context signals report 0% schema description coverage (likely due to the top-level 'params' object lacking a description), the provided schema includes descriptions for each sub-property in the $defs. The description's 'Args' section reiterates all parameters with concise explanations and includes formatting hints (e.g., comma-separated for sections). This adds meaning beyond the schema, especially for optional parameters with defaults (e.g., set_parameters, regenerate). A slight deduction for not explaining the meaning of 'sections' in more detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool assembles markdown controls into an OSCAL Profile JSON file. It specifies the verb 'assemble' and the resource 'Profile JSON from Markdown Directory', distinguishing it from siblings like profile_generate (which likely generates markdown from profile) and profile_resolve (which resolves profiles). The title and first sentence are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit 'Use when' and 'Don't use when' examples, providing clear guidance on appropriate contexts (e.g., CI/CD assembly, parameter expansion) and contraindications (missing or malformed markdown). However, it does not directly compare to sibling tools like trestle_author_profile_generate or trestle_author_profile_resolve, which would further clarify when to choose this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_author_profile_generateGenerate Profile Markdown ControlsA

Generate markdown documentation set for controls defined in specified profile.

This tool extracts controls defined in the specified profile (profiles//profile.json) and generates a set of markdown documents for them. This set can be used for custom documentation, reviews, and organization-specific profile documentation.

Args: params (TrestleAuthorProfileGenerateInput): - name (str): profile name (required) - output (str): output directory for markdown docs (required) - yaml_header (Optional[str]): yaml header file path - force_overwrite (bool): overwrite all in output dir - overwrite_header_values (bool): overwrite header values only - sections (Optional[str]): targeted sections in markdown - required_sections (Optional[str]): required section short names, comma-separated - trestle_root (Optional[str]): workspace root path - verbose (bool): verbose output

Returns: str: Success message or error details

Examples: - Use when: "Generate markdown controls for a given profile" - Use when: "Customize output with required sections or header overwrite" - Don't use when: Profile file does not exist

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses file generation behavior and overwrite options, complementing annotations. Annotations already indicate non-read-only and open-world behavior, and the description adds context about creation and overwriting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is front-loaded with purpose, followed by structured parameter list and examples. Slightly verbose but well-organized and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers input, output (returns string), and usage examples. Lacks some details on default behaviors and output format, but adequate given the output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Though the schema provides descriptions for each property (0% top-level coverage), the tool description lists and explains each parameter, adding clarity on their roles and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Generate markdown documentation set for controls defined in specified profile' with specific verb and resource. It distinguishes from siblings like trestle_author_catalog_generate by focusing on profile controls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit use cases ('Use when: ...') and a negative case ('Don't use when: Profile file does not exist'). However, it does not differentiate from sibling tools like trestle_author_catalog_generate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_author_profile_resolveResolve Profile to CatalogA

Resolve an OSCAL profile to a resolved profile catalog.

This tool resolves a specified OSCAL profile (by name from profiles//profile.json) into an operational, parameter-resolved OSCAL catalog, with flexible output and formatting options.

Args: params (TrestleAuthorProfileResolveInput): - name (str): Source profile name (required) - output (str): Output catalog name (required) - show_values (bool): Show parameter values in prose (optional) - show_labels (bool): Show parameter labels in prose (optional) - bracket_format (str): Bracket format for values (optional) - value_assigned_prefix (str): Prefix if value is assigned (optional) - value_not_assigned_prefix (str): Prefix if value not assigned (optional) - label_prefix (str): Prefix for label output (optional) - verbose (bool): Display verbose output (optional) - trestle_root (str): Path to trestle root directory (optional)

Returns: str: Result summary string. On success, a checked message with output. On failure, a cross mark and error details.

Examples: - Minimal invocation trestle_author_profile_resolve(name="myprofile", output="catalog_resolved") - With options trestle_author_profile_resolve(name="myprofile", output="catalog_resolved", show_values=True, bracket_format="(.)")

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explains the resolution process (resolves to a catalog), mentions output formatting options, and specifies the file path convention ('profiles/<name>/profile.json'). The return type and error behavior are described. Annotations indicate no destructiveness or idempotency, which is consistent. Some behavioral details like file creation are implied but not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear purpose statement, a detailed parameter list, and an examples section. It is front-loaded with the main action, but the parameter list is somewhat lengthy and could be more concise without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main purpose, parameters, return value, and an example. It mentions the file path convention and optional parameters. However, it does not explain prerequisites (e.g., existence of the profile) or the effect of 'trestle_root', leaving some gaps for a complete context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has detailed descriptions for each parameter, and the tool description repeats this information in the Args section with added context like default values and examples. However, the repetition does not significantly add meaning beyond the schema, resulting in a baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'resolve' and the resource 'OSCAL profile to catalog', matching the title. It specifies the operation and distinguishes from sibling tools like 'trestle_author_profile_generate' or 'trestle_author_profile_assemble'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide guidance on when to use this tool over alternatives. No comparisons or explicit conditions are given, leaving the agent to infer context from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_importA

Import an existing OSCAL model into the trestle workspace.

This tool imports OSCAL models from URLs or local file paths. The imported file will be saved in the appropriate directory based on its OSCAL type (e.g., catalogs/, profiles/, component-definitions/).

Import Behavior:

  • Catalog → catalogs/{output}/catalog.json

  • Profile → profiles/{output}/profile.json

  • Component Definition → component-definitions/{output}/component-definition.json

  • SSP → system-security-plans/{output}/system-security-plan.json

Args: params (TrestleImportInput): Validated input parameters containing: - file (str): OSCAL file to import (URL or file path) - output (str): Name of output element - regenerate (bool): Force generation of new UUIDs (default: false) - trestle_root (Optional[str]): Path to trestle root directory - verbose (bool): Display verbose output (default: false)

Returns: str: Success message with import details or error

Examples: - Import NIST SP800-53 Rev5 Catalog: file="https://raw.githubusercontent.com/usnistgov/oscal-content/refs/heads/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json" output="nist_sp800_53_rev5"

- Import from local file:
  file="./resources/catalogs/your_catalog.json"
  output="mycatalog"
ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are sparse but the description adds significant behavioral context: file saving paths per OSCAL type, argument details, and return type. No contradiction with annotations. Describes the import process well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections, front-loaded purpose, and examples. It is somewhat lengthy but each sentence adds value. Could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (one compound parameter with five sub-parameters) and the presence of an output schema, the description covers input format, output, and examples. It is sufficiently complete for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% per context signal, so the description must compensate. It lists all parameters with brief explanations but does not add much beyond the schema's own descriptions. Adequate but not exceptional.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Import an existing OSCAL model into the trestle workspace' and details the types of OSCAL models it handles. It distinguishes itself from sibling tools (generation, assembly, resolution, initialization, CSV conversion) by being the import tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when to use the tool (importing OSCAL models from URLs or local files) and includes examples. It does not explicitly state when not to use it or alternatives, but the sibling tool list implies the context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_initInitialize Trestle WorkspaceA
Idempotent

Initialize a trestle working directory.

This tool initializes the current directory as a Trestle workspace, creating the necessary directory structure for OSCAL model management.

OSCAL Model Types supported:

  • Catalog

  • Profile

  • Component Definition

  • System Security Plan (SSP)

  • Assessment Plan

  • Assessment Result

  • Plan of Action and Milestones (POAM)

Args: params (TrestleInitInput): Validated input parameters containing: - mode (InitMode): Initialization mode (local/full/govdocs, default: local) - trestle_root (Optional[str]): Path to trestle root directory - verbose (bool): Display verbose output (default: false)

Returns: str: Success message or error details

Examples: - Use when: "Initialize trestle workspace" - Use when: "Set up trestle in full mode" - Don't use when: Workspace is already initialized

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate idempotent behavior, which the description does not contradict. The description adds context about creating directory structure and available modes, going beyond what annotations provide. No mention of side effects, but idempotent implies safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with a clear purpose, list of supported models, args section, returns, and examples. Front-loaded with main action, each sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Comprehensive for a initialization tool: covers purpose, modes, return type, and usage examples. Output schema reduces need for extensive return descriptions; the provided 'Success message or error details' is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides descriptions for all parameters (mode, trestle_root, verbose). The description adds no new parameter-level details beyond listing them generically, so it does not significantly improve understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'initialize' and the resource 'trestle working directory'. It lists supported OSCAL model types, distinguishing it from sibling tools like trestle_import or trestle_task_* which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Includes 'Use when' and 'Don't use when' examples, providing clear guidance on appropriate contexts. Does not explicitly mention sibling tools as alternatives, but the 'Don't use when workspace is already initialized' is helpful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_task_csv_to_oscal_cdConvert CSV to OSCAL Component DefinitionA

Convert a CSV file to an OSCAL component definition JSON file.

This tool runs the trestle task csv-to-oscal-cd command, which reads a specially formatted CSV file and produces an OSCAL component_definition .json file.

The CSV must have:

  • Row 1: column headings

  • Row 2: column descriptions

  • Row 3+: data rows

Required CSV columns:

  • $$Component_Title, $$Component_Description, $$Component_Type

  • $$Rule_Id, $$Rule_Description, $$Profile_Source, $$Profile_Description

  • $$Control_Id_List, $$Namespace

Args: params (TrestleTaskCsvToOscalCdInput): Input parameters with: - title (str): Component definition title (required) - version (str): Component definition version (required) - csv_file (str): Path to the input CSV file (required) - output_dir (str): Output directory for OSCAL JSON files (required) - component_definition (Optional[str]): Existing component-definition to update (optional) - output_overwrite (bool): Overwrite existing output (default: true) - validate_controls (str): Control validation mode: on/warn/off (default: off) - class_column_mappings (Optional[dict]): Column-to-class mappings (optional) - trestle_root (Optional[str]): Trestle workspace root path (optional) - verbose (bool): Display verbose output (optional)

Returns: str: Success or error message with output file location

Examples: - Use when: "Convert CSV to OSCAL component definition" - Use when: "Generate component_definition.json from a CSV mapping file" - Don't use when: Input CSV is missing required columns

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations set readOnlyHint=false and destructiveHint=false, so no contradiction. Description explains it produces an output file and returns success/error message, but does not detail potential side effects or permissions beyond file creation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with bullet points and examples, but could be slightly more concise. No redundant sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Comprehensively covers the tool's purpose, input requirements, output, and examples. With an output schema present, no need to describe return values in detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has detailed descriptions for each parameter, so the description adds moderate value by explaining the required CSV columns and overall workflow. Schema coverage is effectively high, so baseline applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool converts CSV to OSCAL component definition JSON. It specifies the command and the CSV format, distinguishing it from sibling trestle tools which handle catalog, profile, import, and init tasks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Includes explicit 'Use when' and 'Don't use when' examples, providing context for appropriate usage. Does not explicitly compare to sibling tools, but the task is specific enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_task_xlsx_to_oscal_poamConvert FedRAMP XLSX to OSCAL POA&MA

Convert a FedRAMP XLSX spreadsheet to an OSCAL POA&M JSON file.

This tool runs the trestle task xlsx-to-oscal-poam command, which reads a FedRAMP-format .xlsx spreadsheet and produces an OSCAL plan-of-action-and-milestones .json file. The converter auto-generates the observations[] and risks[] and cross-links each poam-item to them with deterministic UUIDs.

This command must run inside a trestle workspace: initialize one first with trestle_init and pass its path as trestle_root (or run from within it).

The spreadsheet must have:

  • Row 1: title

  • Rows 2-4: instructions (ignored)

  • Row 5: column headers

  • Row 6+: data rows

Required columns:

  • POAM ID, Weakness Name, Weakness Description, Controls

Args: params (TrestleTaskXlsxToOscalPoamInput): Input parameters with: - title (str): POA&M title (required) - version (str): POA&M version (required) - xlsx_file (str): Path to the input .xlsx file (required) - output_dir (str): Output directory for the OSCAL JSON (required) - work_sheet_name (Optional[str]): Worksheet name (default: 'Open POA&M Items') - system_id (Optional[str]): System identifier (optional) - output_overwrite (bool): Overwrite existing output (default: true) - validate_required_fields (str): Required-field check: on/warn/off (default: warn) - quiet (bool): Suppress per-item output (default: false) - trestle_root (Optional[str]): Trestle workspace root path (optional) - verbose (bool): Display verbose output (optional)

Returns: str: Success or error message with output file location

Examples: - Use when: "Convert this FedRAMP POA&M spreadsheet to OSCAL" - Use when: "Generate plan-of-action-and-milestones.json from an xlsx" - Don't use when: The input is a CSV, or is missing required columns

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide no helpful behavior hints (all false), so the description carries the full burden. It discloses that the task produces a JSON file, auto-generates observations[] and risks[] with deterministic UUIDs, may overwrite existing output via output_overwrite, and requires a trestle workspace. It also explains the spreadsheet row layout and required columns, which are critical behavioral inputs. No contradiction with annotations is present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but the tool is complex and every section earns its place: summary, workspace prerequisite, spreadsheet format, required columns, parameter list, return value, and concrete usage examples. It is front-loaded with the one-line purpose, and the structure makes it easy for an agent to extract the key constraints quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a conversion task with a complex input format, the description is complete: it covers the input file structure, required columns, workspace setup, output location semantics, validation behavior, and exclusion cases. The presence of an output schema slightly reduces the burden for return-value details, but the description still provides a Returns summary. An agent has everything needed to decide whether and how to invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does thoroughly. It enumerates every parameter with its type, default, and whether it is required, including nuanced ones like validate_required_fields ('on/warn/off') and work_sheet_name ('Open POA&M Items'). It also adds meaning to xlsx_file by describing the exact spreadsheet layout and required columns that the schema only briefly touches on.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb+resource+result statement: 'Convert a FedRAMP XLSX spreadsheet to an OSCAL POA&M JSON file.' It names the exact input format, the output format, and the underlying command, making the tool's purpose unmistakable. The sibling-differentiating details are present through the explicit 'Don't use when: The input is a CSV' exclusion, which separates it from CSV-oriented sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use examples ('Convert this FedRAMP POA&M spreadsheet to OSCAL') and when-not-to-use conditions ('Don't use when: The input is a CSV, or is missing required columns'). It also states the prerequisite: the command must run inside a trestle workspace initialized with trestle_init. This gives an agent clear decision criteria and environmental setup guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trestle_validateValidate OSCAL DocumentA
Read-onlyIdempotent

Validate a standalone OSCAL file against the OSCAL schema.

This tool loads the OSCAL document through the trestle model classes, which enforces the OSCAL schema (required fields, field types, enums, UUID formats, and nesting). Optionally it also runs trestle's semantic validators (duplicate UUIDs, broken internal references, links, and rule parameters).

It detects the model type from the file's single top-level wrapper key, so it validates any top-level OSCAL model: catalog, profile, component-definition, system-security-plan, assessment-plan, assessment-results, or plan-of-action-and-milestones.

Unlike trestle validate on the CLI, this works on a standalone file that is not part of a trestle workspace — for example a POA&M JSON produced by an authoring flow.

Args: params (TrestleValidateInput): Input parameters with: - file (str): Path to the OSCAL .json/.yaml/.yml file (required) - expected_model_type (Optional[str]): Enforce the file is this model type (e.g. 'plan-of-action-and-milestones') - semantic (bool): Run semantic validators too (default: true)

Returns: str: A pass/fail message; on failure, the concrete reasons.

Examples: - Use when: "Validate this POA&M JSON is valid OSCAL" file="./poam.json", expected_model_type="plan-of-action-and-milestones" - Use when: "Check that catalog.json conforms to the OSCAL schema" - Don't use when: The file is inside a trestle workspace and you want the full trestle validate workspace checks.

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Read-only, idempotent, non-destructive annotations already establish safety. Beyond that, the description explains model-type auto-detection, optional semantic validators, and what happens on failure, which the annotations do not cover. It provides meaningful behavioral context without contradicting hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a clear summary, an Args section, Returns, and Examples. The essential scope and primary usage are front-loaded, and the 'Don't use when' note appears at the end without bloating the start. Every sentence contributes distinct information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich input schema, output schema, and read-only annotations, the description covers the required inputs, an optional parameter, semantic validation behavior, accepted file formats, supported models, and non-workspace scope. Little is left for the agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though the schema's parameter descriptions are detailed and cover all three fields, the tool description adds value by restating the file path requirement, the default for semantic validation, expected_model_type example values, and the POA&M use case. The description does not fully duplicate the schema, and its examples clarify parameter selection.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb and resource: 'Validate a standalone OSCAL file against the OSCAL schema.' It enumerates supported model types and explicitly contrasts itself with the CLI `trestle validate` on workspaces, giving it distinct identity among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use cases and a 'Don't use when' condition, routing the agent away from the CLI workspace-based validation. Examples map concrete natural-language requests to parameter values, so when-to-use is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv0.2.1
    • Addedtrestle_task_xlsx_to_oscal_poam
    • Addedtrestle_validate
  2. 7 tool updatesv0.1.2
    • First observedtrestle_author_catalog_generate
    • First observedtrestle_author_profile_assemble
    • First observedtrestle_author_profile_generate
    • First observedtrestle_author_profile_resolve
    • First observedtrestle_import
    • First observedtrestle_init
    • First observedtrestle_task_csv_to_oscal_cd

TDQS

A4.2/5.0
Disambiguation5/5

Each tool targets a distinct operation: init, import, catalog markdown generation, profile markdown generation, profile resolution, profile assembly, CSV to component definition, XLSX to POA&M, and validation. The only potentially similar pair is catalog_generate and profile_generate, but they apply to different OSCAL model types and are clearly described.

Naming Consistency4/5

Names follow a recognizable trestle_<domain>_<object>_<action> pattern, especially within the author and task groups. Minor deviations exist for top-level commands like trestle_init, trestle_import, and trestle_validate, but the overall convention is strong and predictable.

Tool Count5/5

Nine tools is well-scoped for a compliance/OSCAL-focused server. Each tool covers a meaningful workflow step without duplication or bloat.

Completeness3/5

The set covers initialization, import, profile authoring/resolution, spreadsheet conversions, and validation. However, catalog authoring is one-directional (generate but no assemble), and there is no general model listing/editing/removal coverage, leaving notable gaps in the full OSCAL authoring lifecycle.

Maintenance

ActivityMaintained
ResponsivenessResponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/oscal-compass/compliance-trestle-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server