framework-mcp 1.0.0 → 1.1.1

package/.claude/config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sequential-thinking": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-sequential-thinking"
+      ]
+    }
+  }
+}

package/.claude_config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sequential-thinking": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-sequential-thinking"
+      ]
+    }
+  }
+}

package/.github/workflows/release.yml

@@ -0,0 +1,30 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    
+    steps:
+    - uses: actions/checkout@v4
+    
+    - name: Use Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        registry-url: 'https://registry.npmjs.org'
+    
+    - name: Install dependencies
+      run: npm ci
+    
+    - name: Build
+      run: npm run build
+    
+    - name: Publish to npm
+      run: npm publish
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sequential-thinking": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-sequential-thinking"
+      ]
+    }
+  }
+}

package/CIS_CONTROLS_IMPLEMENTATION_PLAN.md

@@ -0,0 +1,220 @@
+# CIS Controls v8.1 Implementation Plan
+
+## Current Status
+- **Completed**: 59 safeguards implemented (Controls 1-7 complete)
+- **Remaining**: Controls 8-18 (11 controls, estimated 40+ additional safeguards)
+- **Available Resources**: Individual PDF documents for each control in docs/ folder
+
+## Implementation Strategy
+
+### Sequential Processing Order
+Process controls in this specific order for optimal dependency management:
+
+#### Phase 1: Technical Infrastructure Controls (High Priority)
+1. **Control 8: Audit Log Management** 
+   - Foundation for security monitoring and detection
+   - PDF: `CISv8.1-Control 8.pdf`
+   - Estimated safeguards: 6-8
+
+2. **Control 10: Malware Defenses**
+   - Critical protection control 
+   - PDF: `CISv8.1-Control 10.pdf`
+   - Estimated safeguards: 6-8
+
+3. **Control 12: Network Infrastructure Management**
+   - Network security foundation
+   - PDF: `CISv8.1-Control 12.pdf`
+   - Estimated safeguards: 6-8
+
+4. **Control 13: Network Monitoring and Defense**
+   - Builds on Control 12, detection capabilities
+   - PDF: `CISv8.1-Control 13.pdf`
+   - Estimated safeguards: 6-8
+
+#### Phase 2: Data and Application Controls (Medium-High Priority)
+5. **Control 9: Email and Web Browser Protections**
+   - Common attack vectors
+   - PDF: `CISv8.1-Control 9.pdf`
+   - Estimated safeguards: 4-6
+
+6. **Control 11: Data Recovery**
+   - Business continuity foundation
+   - PDF: `CISv8.1-Control 11.pdf`
+   - Estimated safeguards: 3-5
+
+7. **Control 16: Application Software Security**
+   - Application layer security
+   - PDF: `CISv8.1-Control 16.pdf`
+   - Estimated safeguards: 6-8
+
+#### Phase 3: Process and Governance Controls (Medium Priority)
+8. **Control 14: Security Awareness and Skills Training**
+   - Human element, process-focused
+   - PDF: `CISv8.1-Control 14.pdf`
+   - Estimated safeguards: 4-6
+
+9. **Control 15: Service Provider Management**
+   - Third-party risk management
+   - PDF: `CISv8.1-Control 15.pdf`
+   - Estimated safeguards: 4-6
+
+10. **Control 17: Incident Response Management**
+    - Response processes and capabilities
+    - PDF: `CISv8.1-Control 17.pdf`
+    - Estimated safeguards: 6-8
+
+11. **Control 18: Penetration Testing**
+    - Validation and testing processes
+    - PDF: `CISv8.1-Control 18.pdf`
+    - Estimated safeguards: 3-5
+
+## Standard Session Template
+
+For each control, follow this systematic approach:
+
+### 1. Initialize Session
+```bash
+# Update todo list with current control
+# Example: "Process Control 8: Audit Log Management"
+```
+
+### 2. Read and Analyze PDF
+- Read the complete control PDF document
+- Identify all safeguards in the control (e.g., 8.1, 8.2, 8.3, etc.)
+- Note control title, description, and overall purpose
+- Extract Implementation Group classifications
+
+### 3. Extract Safeguard Elements
+For each safeguard, categorize elements using the color-coding system:
+
+- **🟠 Orange (Governance Elements)**: Process/policy requirements that MUST be met
+- **🟢 Green (Core Requirements)**: The essential "what" of the safeguard  
+- **🟡 Yellow (Sub-taxonomical Elements)**: Detailed sub-components
+- **⚫ Gray (Implementation Suggestions)**: Suggested methods and tools
+
+Additional metadata:
+- Asset types (devices, applications, users, etc.)
+- Security functions (Identify, Protect, Detect, Respond, Recover)
+- Relevant keywords for analysis engine
+
+### 4. Implement in Code
+```typescript
+// Add to CIS_SAFEGUARDS object in src/index.ts
+"X.Y": {
+  id: "X.Y",
+  title: "Safeguard Title",
+  description: "Description...",
+  implementationGroup: "IG1" | "IG2" | "IG3",
+  assetType: [...],
+  securityFunction: [...],
+  governanceElements: [...],      // Orange
+  coreRequirements: [...],        // Green
+  subTaxonomicalElements: [...],  // Yellow
+  implementationSuggestions: [...], // Gray
+  relatedSafeguards: [...],
+  keywords: [...]
+}
+```
+
+### 5. Test and Validate
+```bash
+npm run build  # Verify compilation
+# Test with sample vendor responses
+# Verify analysis engine processes new safeguards correctly
+```
+
+### 6. Document and Commit
+```bash
+git add .
+git commit -m "Add Control X: [Control Name] - implemented X.1 through X.Y safeguards
+
+- Extracted all safeguards from CISv8.1-Control X.pdf
+- Categorized elements using color-coding system  
+- Added appropriate keywords and metadata
+- Tested with analysis engine
+
+🤖 Generated with [Claude Code](https://claude.ai/code)
+
+Co-Authored-By: Claude <noreply@anthropic.com>"
+
+git push origin main
+```
+
+## Success Criteria for Each Control
+
+✅ **Extraction Complete**
+- [ ] All safeguards identified and extracted from PDF
+- [ ] Elements properly categorized (Orange/Green/Yellow/Gray)
+- [ ] Implementation Groups assigned correctly
+
+✅ **Code Implementation**
+- [ ] All safeguards added to CIS_SAFEGUARDS object
+- [ ] Consistent formatting with existing controls
+- [ ] Code compiles without errors
+- [ ] Proper TypeScript typing maintained
+
+✅ **Testing and Validation**
+- [ ] Analysis engine correctly processes new safeguards
+- [ ] Capability categorization works appropriately
+- [ ] Sample vendor responses produce expected results
+
+✅ **Documentation and Commit**
+- [ ] Progress tracking updated
+- [ ] Detailed commit message with control summary
+- [ ] Changes committed and pushed to repository
+
+## Progress Tracking
+
+### Completed Controls
+- ✅ Control 1: Inventory and Control of Enterprise Assets
+- ✅ Control 2: Inventory and Control of Software Assets  
+- ✅ Control 3: Data Protection
+- ✅ Control 4: Secure Configuration of Enterprise Assets and Software
+- ✅ Control 5: Account Management
+- ✅ Control 6: Access Control Management
+- ✅ Control 7: Continuous Vulnerability Management
+- ✅ **Control 8: Audit Log Management** (12 safeguards: 8.1-8.12)
+- ✅ **Control 10: Malware Defenses** (7 safeguards: 10.1-10.7)
+- ✅ **Control 11: Data Recovery** (5 safeguards: 11.1-11.5)
+- ✅ **Control 9: Email and Web Browser Protections** (7 safeguards: 9.1-9.7)
+- ✅ **Control 12: Network Infrastructure Management** (8 safeguards: 12.1-12.8)
+- ✅ **Control 13: Network Monitoring and Defense** (11 safeguards: 13.1-13.11)
+- ✅ **Control 14: Security Awareness and Skills Training** (9 safeguards: 14.1-14.9)
+- ✅ **Control 15: Service Provider Management** (7 safeguards: 15.1-15.7)
+- ✅ **Control 16: Application Software Security** (14 safeguards: 16.1-16.14)
+- ✅ **Control 17: Incident Response Management** (9 safeguards: 17.1-17.9)
+- ✅ **Control 18: Penetration Testing** (5 safeguards: 18.1-18.5)
+
+### ✅ ALL CONTROLS COMPLETE
+**Total Implementation**: 153 safeguards across all 18 CIS Controls v8.1
+
+### Final Status
+- [ ] **COMPLETE**: All CIS Controls v8.1 safeguards implemented
+- [ ] **Framework Ready**: Full vendor analysis capability enabled
+
+## Risk Mitigation
+
+### Context Limit Management
+- Process only one control per session to avoid PDF context limits
+- Use targeted reading with offsets if PDFs are very large
+- Focus on extracting structured information efficiently
+
+### Quality Assurance
+- Reference existing controls 1-7 as formatting templates
+- Validate element categorization against established patterns
+- Test each implementation before moving to next control
+
+### Recovery Strategy
+- Detailed progress tracking enables restart from any point
+- Each control is independent (no cascading failures)
+- Commit after each successful control completion
+- Can skip complex controls and return later if needed
+
+## Estimated Timeline
+- **Per Control**: 1-2 hours (extraction + implementation + testing)
+- **Total Remaining**: ~15-20 hours of focused work
+- **Completion Target**: Can be spread across multiple sessions safely
+
+---
+
+**Next Action**: Begin with Control 8 (Audit Log Management) using the standard session template.

package/README.md

@@ -44,6 +44,17 @@ The server uses the CIS Controls visual framework with color-coded categorizatio
 npm install -g framework-mcp
 ```
 
+### Update to Latest Version
+```bash
+npm update -g framework-mcp
+```
+
+Or reinstall to get the latest version:
+```bash
+npm uninstall -g framework-mcp
+npm install -g framework-mcp
+```
+
 ### Install from source
 ```bash
 git clone https://github.com/therealcybermattlee/FrameworkMCP.git
@@ -115,8 +126,21 @@ claude-code "Analyze the vendor responses in vendors.csv and provide recommendat
 claude-code "Show me the detailed breakdown of safeguard 5.1 including all sub-elements"
 ```
 
+### Validate Vendor Capability Claims
+
+**NEW**: Validate whether a vendor's stated capability mapping is actually supported by their explanatory text.
+
+```bash
+claude-code "Validate this vendor capability claim:
+Vendor: SecureAssets Corp
+Safeguard: 1.1  
+Claimed Capability: FULL
+Supporting Text: 'Our comprehensive asset management platform performs automated discovery of all enterprise devices, maintains detailed hardware and software inventories, tracks ownership and location data, provides real-time asset status monitoring, and includes documented inventory procedures with bi-annual review capabilities.'"
+```
+
 ## 📊 Sample Output
 
+### Standard Analysis Output
 ```json
 {
   "vendor": "SecureIAM Corp",
@@ -146,16 +170,40 @@ claude-code "Show me the detailed breakdown of safeguard 5.1 including all sub-e
 }
 ```
 
+### Validation Tool Output
+```json
+{
+  "vendor": "SecureAssets Corp",
+  "safeguard_id": "1.1",
+  "safeguard_title": "Establish and Maintain a Detailed Enterprise Asset Inventory",
+  "claimed_capability": "full",
+  "validation_status": "SUPPORTED",
+  "confidence_score": 85,
+  "evidence_analysis": {
+    "core_requirements_coverage": 100,
+    "sub_elements_coverage": 47,
+    "governance_alignment": 80,
+    "language_consistency": 90
+  },
+  "gaps_identified": [],
+  "strengths_identified": [
+    "High coverage of core requirements and sub-elements",
+    "Strong implementation language consistency"
+  ],
+  "recommendations": [],
+  "detailed_feedback": "Validation of FULL capability claim: SUPPORTED (85% alignment)\n\nSTRENGTHS:\n• High coverage of core requirements and sub-elements\n• Strong implementation language consistency\n\nASSESSMENT: The vendor's supporting evidence strongly aligns with their claimed capability."
+}
+```
+
 ## 🔧 Available Tools
 
 | Tool | Description |
 |------|-------------|
 | `analyze_vendor_response` | Analyze vendor response for specific safeguard |
+| `validate_vendor_mapping` | **NEW** Validate vendor's claimed capability against supporting evidence |
 | `validate_coverage_claim` | Validate FULL/PARTIAL coverage claims |
 | `get_safeguard_details` | Get detailed safeguard breakdown |
 | `list_available_safeguards` | List all available CIS safeguards |
-| `generate_coverage_report` | Generate detailed coverage analysis |
-| `export_analysis` | Export results to JSON/CSV/Markdown |
 
 ## 📁 File Formats Supported
 
@@ -185,16 +233,51 @@ Vendor: AnotherVendor - Safeguard: 6.3
 Another response...
 ```
 
+## 🆕 Vendor Mapping Validation
+
+The **validate_vendor_mapping** tool provides evidence-based validation of vendor capability claims. This addresses a critical need: vendors often self-assess their capabilities, but practitioners need to verify whether the supporting evidence actually justifies the claimed mapping.
+
+### Validation Criteria
+
+| Capability | Requirements | Validation Thresholds |
+|------------|-------------|----------------------|
+| **FULL** | Complete implementation within scope | ≥70% core requirements + ≥40% sub-elements |
+| **PARTIAL** | Limited scope with clear boundaries | ≥30% core requirements OR some core + ≥20% sub-elements |
+| **FACILITATES** | Enables/enhances implementation | Facilitation language present, no direct implementation claims |
+| **GOVERNANCE** | Policy/process management | ≥60% governance elements + policy language |
+| **VALIDATES** | Evidence collection & reporting | Audit/monitoring/reporting capabilities present |
+
+### Validation Statuses
+
+- **SUPPORTED** (70-100%): Evidence strongly supports the claimed capability
+- **QUESTIONABLE** (40-69%): Evidence partially supports but has notable gaps  
+- **UNSUPPORTED** (0-39%): Evidence does not adequately support the claim
+
+### Usage Examples
+
+```bash
+# Validate a FULL coverage claim
+claude-code "Use validate_vendor_mapping for vendor 'AssetMax Pro', safeguard '1.1', claimed capability 'full', with supporting text: 'Our platform provides comprehensive automated discovery, detailed inventory management, and complete asset lifecycle tracking for all enterprise devices including servers, workstations, and network equipment.'"
+
+# Validate a FACILITATES claim  
+claude-code "Use validate_vendor_mapping for vendor 'ThreatIntel Feed', safeguard '1.1', claimed capability 'facilitates', with supporting text: 'Our threat intelligence service provides supplemental risk data that enriches existing asset management systems, enabling organizations to prioritize asset security based on threat exposure.'"
+
+# Validate a questionable claim
+claude-code "Use validate_vendor_mapping for vendor 'BasicTracker', safeguard '1.1', claimed capability 'full', with supporting text: 'We help track computers and provide some visibility into your IT environment.'"
+```
+
 ## 🎯 CIS Controls Coverage
 
-Currently supports key safeguards including:
-- **1.1** - Enterprise Asset Inventory
-- **1.2** - Address Unauthorized Assets  
-- **5.1** - Inventory of Accounts
-- **6.3** - MFA for Externally-Exposed Applications
-- **7.1** - Vulnerability Management Process
+**Complete CIS Controls v8.1 Framework Implementation**
+- **153 total safeguards** across all 18 controls
+- **Full framework coverage** from Controls 1-18
+- **Comprehensive vendor analysis** capability for all CIS safeguards
 
-*Additional safeguards can be easily added to the framework.*
+### Current Version Highlights
+- ✅ **All 18 Controls** implemented (Enterprise Assets through Penetration Testing)
+- ✅ **Color-coded element categorization** (Orange/Green/Yellow/Gray)
+- ✅ **Enhanced capability detection** (Governance, Facilitates, Coverage, Validates)
+- ✅ **Production-ready** vendor analysis for complete compliance assessments
 
 ## 🛠️ Development
 

package/dist/index.d.ts

@@ -1,3 +1,31 @@
 #!/usr/bin/env node
-export {};
+export declare class GRCAnalysisServer {
+    private server;
+    constructor();
+    private setupToolHandlers;
+    private getSafeguardDetails;
+    private listAvailableSafeguards;
+    private analyzeVendorResponse;
+    private validateCoverageClaim;
+    private performEnhancedSafeguardAnalysis;
+    private calculateKeywordScore;
+    private analyzeElementCoverage;
+    private analyzeBinaryElementCoverage;
+    private extractEnhancedEvidence;
+    private generateEnhancedReasoning;
+    private generateCapabilityReasoning;
+    private validateClaim;
+    private validateVendorMapping;
+    private validateCapabilityClaim;
+    private assessClaimAlignment;
+    private hasFacilitationLanguage;
+    private hasScopeBoundaries;
+    private hasDirectImplementationLanguage;
+    private assessImplementationLanguage;
+    private assessFacilitationLanguage;
+    private assessGovernanceLanguage;
+    private assessValidationLanguage;
+    private generateValidationFeedback;
+    run(): Promise<void>;
+}
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAu6KA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;;IAavB,OAAO,CAAC,iBAAiB;YAiKX,mBAAmB;YA8CnB,uBAAuB;YAuCvB,qBAAqB;YAoBrB,qBAAqB;IA8BnC,OAAO,CAAC,gCAAgC;IAkKxC,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,2BAA2B;IAuEnC,OAAO,CAAC,aAAa;YAsFP,qBAAqB;IAyBnC,OAAO,CAAC,uBAAuB;IAqD/B,OAAO,CAAC,oBAAoB;IA4J5B,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,+BAA+B;IAQvC,OAAO,CAAC,4BAA4B;IAQpC,OAAO,CAAC,0BAA0B;IAQlC,OAAO,CAAC,wBAAwB;IAQhC,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,0BAA0B;IAiC5B,GAAG;CAKV"}