@aigrc/mcp 2.0.0

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@aigrc/mcp",
+  "version": "2.0.0",
+  "description": "AIGRC MCP Server - AI Governance via Model Context Protocol",
+  "license": "Apache-2.0",
+  "author": "AIGRC <contact@aigrc.dev>",
+  "homepage": "https://github.com/aigrc/aigrc#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aigrc/aigrc.git",
+    "directory": "packages/mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/aigrc/aigrc/issues"
+  },
+  "keywords": [
+    "aigrc",
+    "mcp",
+    "model-context-protocol",
+    "ai-governance",
+    "compliance",
+    "eu-ai-act",
+    "nist-ai-rmf",
+    "iso-42001",
+    "claude",
+    "anthropic"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "aigrc-mcp": "./dist/bin/aigrc-mcp.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "profiles"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "clean": "rimraf dist",
+    "start": "node dist/bin/aigrc-mcp.js"
+  },
+  "dependencies": {
+    "@aigrc/core": "^0.1.0",
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "glob": "^10.3.10",
+    "yaml": "^2.3.4",
+    "zod": "^3.22.4"
+  },
+  "devDependencies": {
+    "@types/node": "^20.10.0",
+    "rimraf": "^5.0.5",
+    "tsup": "^8.0.1",
+    "typescript": "^5.3.2"
+  }
+}

package/profiles/eu-ai-act.yaml

@@ -0,0 +1,166 @@
+# EU AI Act Compliance Profile
+# European Union Artificial Intelligence Act
+
+id: eu-ai-act
+name: EU AI Act
+version: "2024.1"
+jurisdiction: EU
+description: European Union Artificial Intelligence Act
+effectiveDate: "2024-08-01"
+sourceDocument: Regulation (EU) 2024/1689
+sourceUrl: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
+
+riskLevels:
+  - minimal
+  - limited
+  - high
+  - unacceptable
+
+riskLevelMapping:
+  minimal: minimal
+  limited: limited
+  high: high
+  unacceptable: unacceptable
+
+trustworthinessCharacteristics:
+  - transparency
+  - safety
+  - security
+  - fairness
+  - accountability
+  - human_oversight
+
+controls:
+  - id: eu-art-9
+    name: Risk Management System
+    description: Establish and maintain a risk management system
+    applicableRiskLevels:
+      - high
+    required: true
+    category: Risk Management
+    crosswalkIds:
+      us-omb-m24:
+        - us-aia
+      nist-ai-rmf:
+        - nist-govern
+        - nist-manage
+      iso-42001:
+        - iso-a6
+
+  - id: eu-art-10
+    name: Data Governance
+    description: Training, validation and testing data governance
+    applicableRiskLevels:
+      - high
+    required: true
+    category: Data Governance
+    crosswalkIds:
+      nist-ai-rmf:
+        - nist-map
+      iso-42001:
+        - iso-a8
+
+  - id: eu-art-11
+    name: Technical Documentation
+    description: Comprehensive technical documentation
+    applicableRiskLevels:
+      - high
+    required: true
+    category: Documentation
+    crosswalkIds:
+      nist-ai-rmf:
+        - nist-map
+      iso-42001:
+        - iso-a7
+
+  - id: eu-art-12
+    name: Record Keeping
+    description: Automatic logging and record keeping
+    applicableRiskLevels:
+      - high
+    required: true
+    category: Logging
+    crosswalkIds:
+      nist-ai-rmf:
+        - nist-measure
+      iso-42001:
+        - iso-a9
+
+  - id: eu-art-13
+    name: Transparency
+    description: Transparency and provision of information to deployers
+    applicableRiskLevels:
+      - high
+      - limited
+    required: true
+    category: Transparency
+    crosswalkIds:
+      us-omb-m24:
+        - us-notice
+      nist-ai-rmf:
+        - nist-govern
+      iso-42001:
+        - iso-a7
+
+  - id: eu-art-14
+    name: Human Oversight
+    description: Human oversight measures
+    applicableRiskLevels:
+      - high
+    required: true
+    category: Oversight
+    crosswalkIds:
+      us-omb-m24:
+        - us-human-oversight
+      nist-ai-rmf:
+        - nist-govern
+      iso-42001:
+        - iso-a8
+
+  - id: eu-art-15
+    name: Accuracy and Robustness
+    description: Accuracy, robustness and cybersecurity
+    applicableRiskLevels:
+      - high
+    required: true
+    category: Technical
+    crosswalkIds:
+      us-omb-m24:
+        - us-safety-testing
+      nist-ai-rmf:
+        - nist-measure
+      iso-42001:
+        - iso-a9
+
+  - id: eu-art-50
+    name: Transparency Obligations
+    description: Inform users of AI interaction
+    applicableRiskLevels:
+      - limited
+    required: true
+    category: Transparency
+
+artifactTemplates:
+  - id: risk-management-plan
+    name: Risk Management Plan
+    description: Article 9 compliant risk management documentation
+    format: markdown
+    requiredFor:
+      - high
+    templatePath: templates/eu/risk-management-plan.md
+
+  - id: technical-documentation
+    name: Technical Documentation
+    description: Article 11 compliant technical documentation
+    format: markdown
+    requiredFor:
+      - high
+    templatePath: templates/eu/technical-documentation.md
+
+  - id: conformity-declaration
+    name: EU Declaration of Conformity
+    description: Self-declaration of conformity
+    format: pdf
+    requiredFor:
+      - high
+    templatePath: templates/eu/conformity-declaration.md

package/profiles/iso-42001.yaml

@@ -0,0 +1,162 @@
+# ISO/IEC 42001 Compliance Profile
+# AI Management System Standard
+
+id: iso-42001
+name: ISO/IEC 42001
+version: "2023"
+jurisdiction: International
+description: AI Management System Standard
+sourceDocument: ISO/IEC 42001:2023
+sourceUrl: https://www.iso.org/standard/81230.html
+
+riskLevels:
+  - low
+  - medium
+  - high
+  - critical
+
+riskLevelMapping:
+  minimal: low
+  limited: medium
+  high: high
+  unacceptable: critical
+
+trustworthinessCharacteristics:
+  - reliability
+  - safety
+  - security
+  - transparency
+  - accountability
+  - fairness
+  - privacy
+
+controls:
+  - id: iso-a5
+    name: Leadership and Commitment
+    description: Top management commitment to AIMS
+    applicableRiskLevels:
+      - low
+      - medium
+      - high
+      - critical
+    required: true
+    category: Leadership
+    crosswalkIds:
+      nist-ai-rmf:
+        - nist-govern
+
+  - id: iso-a6
+    name: Planning
+    description: AI risk and opportunity planning
+    applicableRiskLevels:
+      - low
+      - medium
+      - high
+      - critical
+    required: true
+    category: Planning
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-9
+      us-omb-m24:
+        - us-aia
+      nist-ai-rmf:
+        - nist-govern
+        - nist-map
+
+  - id: iso-a7
+    name: Support
+    description: Resources, competence, awareness
+    applicableRiskLevels:
+      - medium
+      - high
+      - critical
+    required: true
+    category: Support
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-11
+        - eu-art-13
+      us-omb-m24:
+        - us-notice
+      nist-ai-rmf:
+        - nist-map
+
+  - id: iso-a8
+    name: Operation
+    description: Operational planning and control
+    applicableRiskLevels:
+      - medium
+      - high
+      - critical
+    required: true
+    category: Operations
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-10
+        - eu-art-14
+      us-omb-m24:
+        - us-human-oversight
+      nist-ai-rmf:
+        - nist-manage
+
+  - id: iso-a9
+    name: Performance Evaluation
+    description: Monitoring, measurement, analysis
+    applicableRiskLevels:
+      - medium
+      - high
+      - critical
+    required: true
+    category: Performance
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-12
+        - eu-art-15
+      us-omb-m24:
+        - us-safety-testing
+      nist-ai-rmf:
+        - nist-measure
+
+  - id: iso-a10
+    name: Improvement
+    description: Continual improvement
+    applicableRiskLevels:
+      - high
+      - critical
+    required: true
+    category: Improvement
+    crosswalkIds:
+      nist-ai-rmf:
+        - nist-manage
+
+artifactTemplates:
+  - id: aims-policy
+    name: AIMS Policy
+    description: AI Management System Policy
+    format: markdown
+    requiredFor:
+      - low
+      - medium
+      - high
+      - critical
+    templatePath: templates/iso/aims-policy.md
+
+  - id: aims-manual
+    name: AIMS Manual
+    description: AI Management System Manual
+    format: markdown
+    requiredFor:
+      - high
+      - critical
+    templatePath: templates/iso/aims-manual.md
+
+  - id: risk-treatment-plan
+    name: Risk Treatment Plan
+    description: AI risk treatment plan
+    format: markdown
+    requiredFor:
+      - medium
+      - high
+      - critical
+    templatePath: templates/iso/risk-treatment-plan.md

package/profiles/nist-ai-rmf.yaml

@@ -0,0 +1,136 @@
+# NIST AI Risk Management Framework Profile
+# NIST AI RMF 1.0
+
+id: nist-ai-rmf
+name: NIST AI RMF
+version: "1.0"
+jurisdiction: US
+description: NIST AI Risk Management Framework
+sourceDocument: NIST AI RMF 1.0
+sourceUrl: https://www.nist.gov/itl/ai-risk-management-framework
+
+riskLevels:
+  - minimal
+  - low
+  - moderate
+  - high
+  - critical
+
+riskLevelMapping:
+  minimal: minimal
+  limited: low
+  high: high
+  unacceptable: critical
+
+trustworthinessCharacteristics:
+  - valid
+  - reliable
+  - safe
+  - secure
+  - accountable
+  - transparent
+  - explainable
+  - privacy_enhanced
+  - fair
+
+controls:
+  - id: nist-govern
+    name: GOVERN Function
+    description: AI governance policies and procedures
+    applicableRiskLevels:
+      - minimal
+      - low
+      - moderate
+      - high
+      - critical
+    required: true
+    category: Governance
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-9
+        - eu-art-13
+        - eu-art-14
+      us-omb-m24:
+        - us-aia
+        - us-human-oversight
+        - us-notice
+      iso-42001:
+        - iso-a5
+        - iso-a6
+
+  - id: nist-map
+    name: MAP Function
+    description: Context and risk mapping
+    applicableRiskLevels:
+      - low
+      - moderate
+      - high
+      - critical
+    required: true
+    category: Risk Mapping
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-10
+        - eu-art-11
+      iso-42001:
+        - iso-a6
+        - iso-a7
+
+  - id: nist-measure
+    name: MEASURE Function
+    description: Risk measurement and monitoring
+    applicableRiskLevels:
+      - low
+      - moderate
+      - high
+      - critical
+    required: true
+    category: Measurement
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-12
+        - eu-art-15
+      us-omb-m24:
+        - us-safety-testing
+      iso-42001:
+        - iso-a9
+
+  - id: nist-manage
+    name: MANAGE Function
+    description: Risk treatment and response
+    applicableRiskLevels:
+      - low
+      - moderate
+      - high
+      - critical
+    required: true
+    category: Management
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-9
+      us-omb-m24:
+        - us-aia
+        - us-equity
+      iso-42001:
+        - iso-a8
+        - iso-a10
+
+artifactTemplates:
+  - id: nist-profile
+    name: NIST AI RMF Profile
+    description: Organization-specific AI RMF profile
+    format: yaml
+    requiredFor:
+      - moderate
+      - high
+      - critical
+    templatePath: templates/nist/ai-rmf-profile.yaml
+
+  - id: nist-playbook
+    name: NIST AI RMF Playbook
+    description: Implementation playbook for AI RMF
+    format: markdown
+    requiredFor:
+      - high
+      - critical
+    templatePath: templates/nist/ai-rmf-playbook.md

package/profiles/us-omb-m24.yaml

@@ -0,0 +1,131 @@
+# US OMB M-24-10/M-24-18 Compliance Profile
+# US Federal AI Governance Memoranda
+
+id: us-omb-m24
+name: US OMB M-24-10/M-24-18
+version: "2024.1"
+jurisdiction: US
+description: US Federal AI governance memoranda for rights-impacting and safety-impacting AI
+effectiveDate: "2024-12-01"
+sourceDocument: OMB Memorandum M-24-10, M-24-18
+sourceUrl: https://www.whitehouse.gov/omb/briefing-room/2024/03/28/omb-releases-implementation-guidance-following-president-bidens-executive-order-on-artificial-intelligence/
+
+riskLevels:
+  - neither
+  - rights-impacting
+  - safety-impacting
+
+riskLevelMapping:
+  minimal: neither
+  limited: neither
+  high: rights-impacting
+  unacceptable: safety-impacting
+
+trustworthinessCharacteristics:
+  - safety
+  - equity
+  - transparency
+  - accountability
+  - human_oversight
+
+controls:
+  - id: us-aia
+    name: AI Impact Assessment
+    description: Documented AI Impact Assessment
+    applicableRiskLevels:
+      - rights-impacting
+      - safety-impacting
+    required: true
+    category: Assessment
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-9
+      nist-ai-rmf:
+        - nist-govern
+        - nist-manage
+      iso-42001:
+        - iso-a6
+
+  - id: us-human-oversight
+    name: Human Oversight
+    description: Meaningful human oversight mechanisms
+    applicableRiskLevels:
+      - rights-impacting
+      - safety-impacting
+    required: true
+    category: Oversight
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-14
+      nist-ai-rmf:
+        - nist-govern
+      iso-42001:
+        - iso-a8
+
+  - id: us-equity
+    name: Equity Assessment
+    description: Assessment of disparate impacts
+    applicableRiskLevels:
+      - rights-impacting
+    required: true
+    category: Equity
+    crosswalkIds:
+      nist-ai-rmf:
+        - nist-manage
+
+  - id: us-notice
+    name: Affected Individual Notice
+    description: Notice to individuals affected by AI decisions
+    applicableRiskLevels:
+      - rights-impacting
+    required: true
+    category: Transparency
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-13
+        - eu-art-50
+      nist-ai-rmf:
+        - nist-govern
+      iso-42001:
+        - iso-a7
+
+  - id: us-appeal
+    name: Appeal Process
+    description: Process for affected individuals to appeal
+    applicableRiskLevels:
+      - rights-impacting
+    required: true
+    category: Remediation
+
+  - id: us-safety-testing
+    name: Safety Testing
+    description: Comprehensive safety testing documentation
+    applicableRiskLevels:
+      - safety-impacting
+    required: true
+    category: Testing
+    crosswalkIds:
+      eu-ai-act:
+        - eu-art-15
+      nist-ai-rmf:
+        - nist-measure
+      iso-42001:
+        - iso-a9
+
+artifactTemplates:
+  - id: ai-impact-assessment
+    name: AI Impact Assessment
+    description: OMB required impact assessment
+    format: markdown
+    requiredFor:
+      - rights-impacting
+      - safety-impacting
+    templatePath: templates/us/ai-impact-assessment.md
+
+  - id: equity-assessment
+    name: Equity Assessment
+    description: Disparate impact analysis
+    format: markdown
+    requiredFor:
+      - rights-impacting
+    templatePath: templates/us/equity-assessment.md