Home › Servers › OSCAL (AWS Labs)

OSCAL (AWS Labs) MCP server

An AWS Labs server for OSCAL security-control documents. It is a different registry entry from the AWS MCP Server.

Transport	stdio (local, pypi)
Auth	No secrets declared in registry entry
Registry name	io.github.awslabs/mcp-server-for-oscal · 0.4.0
Source	https://github.com/awslabs/mcp-server-for-oscal
Remote endpoints	None declared
Data source	Official MCP Registry
Date checked	2026-10-17

Install

Configs are generated only from packages and remotes on the registry entry. Empty optional flags are listed instead of inserted. Nothing is added that the entry does not declare.

Local package (pypi)

Claude Desktop · mcpServers

{
  "mcpServers": {
    "oscal": {
      "command": "uvx",
      "args": [
        "[email protected]"
      ]
    }
  }
}

Cursor · mcpServers

{
  "mcpServers": {
    "oscal": {
      "command": "uvx",
      "args": [
        "[email protected]"
      ]
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "oscal": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "[email protected]"
      ]
    }
  }
}

Claude Code · .mcp.json

{
  "mcpServers": {
    "oscal": {
      "command": "uvx",
      "args": [
        "[email protected]"
      ]
    }
  }
}

claude mcp add

claude mcp add oscal -- uvx [email protected]

Optional environment variables

Not placed in the snippet. Names declared on the entry:

BEDROCK_MODEL_ID
OSCAL_KB_ID
AWS_PROFILE
AWS_REGION
LOG_LEVEL

FAQ

What transport does OSCAL (AWS Labs) use?

stdio (local, pypi).

What credentials are declared for OSCAL (AWS Labs)?

No secrets declared in registry entry.

When was this checked, and what is the source?

These facts were checked on 2026-10-17. Registry name: io.github.awslabs/mcp-server-for-oscal. Source: https://github.com/awslabs/mcp-server-for-oscal.

Similar servers

Auth0

Security & Identity

Manages Auth0 tenants (applications, APIs, actions, logs, forms) through conversational requests.

stdio (local, npm)

Microsoft Sentinel

Security & Identity

Microsoft's hosted server for exploring security data in a Sentinel data lake.

Streamable HTTP (remote)

Snyk

Security & Identity

Runs Snyk security scans from an agent so vulnerabilities can be found and fixed in code.

stdio (local, npm)

SonarQube

Security & Identity

SonarSource's local server for code quality and security findings in SonarQube Server or Cloud.

stdio (local, oci)