framework-mcp 1.1.0 → 1.1.1

package/README.md

@@ -44,6 +44,17 @@ The server uses the CIS Controls visual framework with color-coded categorizatio
 npm install -g framework-mcp
 ```
 
+### Update to Latest Version
+```bash
+npm update -g framework-mcp
+```
+
+Or reinstall to get the latest version:
+```bash
+npm uninstall -g framework-mcp
+npm install -g framework-mcp
+```
+
 ### Install from source
 ```bash
 git clone https://github.com/therealcybermattlee/FrameworkMCP.git
@@ -115,8 +126,21 @@ claude-code "Analyze the vendor responses in vendors.csv and provide recommendat
 claude-code "Show me the detailed breakdown of safeguard 5.1 including all sub-elements"
 ```
 
+### Validate Vendor Capability Claims
+
+**NEW**: Validate whether a vendor's stated capability mapping is actually supported by their explanatory text.
+
+```bash
+claude-code "Validate this vendor capability claim:
+Vendor: SecureAssets Corp
+Safeguard: 1.1  
+Claimed Capability: FULL
+Supporting Text: 'Our comprehensive asset management platform performs automated discovery of all enterprise devices, maintains detailed hardware and software inventories, tracks ownership and location data, provides real-time asset status monitoring, and includes documented inventory procedures with bi-annual review capabilities.'"
+```
+
 ## 📊 Sample Output
 
+### Standard Analysis Output
 ```json
 {
   "vendor": "SecureIAM Corp",
@@ -146,16 +170,40 @@ claude-code "Show me the detailed breakdown of safeguard 5.1 including all sub-e
 }
 ```
 
+### Validation Tool Output
+```json
+{
+  "vendor": "SecureAssets Corp",
+  "safeguard_id": "1.1",
+  "safeguard_title": "Establish and Maintain a Detailed Enterprise Asset Inventory",
+  "claimed_capability": "full",
+  "validation_status": "SUPPORTED",
+  "confidence_score": 85,
+  "evidence_analysis": {
+    "core_requirements_coverage": 100,
+    "sub_elements_coverage": 47,
+    "governance_alignment": 80,
+    "language_consistency": 90
+  },
+  "gaps_identified": [],
+  "strengths_identified": [
+    "High coverage of core requirements and sub-elements",
+    "Strong implementation language consistency"
+  ],
+  "recommendations": [],
+  "detailed_feedback": "Validation of FULL capability claim: SUPPORTED (85% alignment)\n\nSTRENGTHS:\n• High coverage of core requirements and sub-elements\n• Strong implementation language consistency\n\nASSESSMENT: The vendor's supporting evidence strongly aligns with their claimed capability."
+}
+```
+
 ## 🔧 Available Tools
 
 | Tool | Description |
 |------|-------------|
 | `analyze_vendor_response` | Analyze vendor response for specific safeguard |
+| `validate_vendor_mapping` | **NEW** Validate vendor's claimed capability against supporting evidence |
 | `validate_coverage_claim` | Validate FULL/PARTIAL coverage claims |
 | `get_safeguard_details` | Get detailed safeguard breakdown |
 | `list_available_safeguards` | List all available CIS safeguards |
-| `generate_coverage_report` | Generate detailed coverage analysis |
-| `export_analysis` | Export results to JSON/CSV/Markdown |
 
 ## 📁 File Formats Supported
 
@@ -185,16 +233,51 @@ Vendor: AnotherVendor - Safeguard: 6.3
 Another response...
 ```
 
+## 🆕 Vendor Mapping Validation
+
+The **validate_vendor_mapping** tool provides evidence-based validation of vendor capability claims. This addresses a critical need: vendors often self-assess their capabilities, but practitioners need to verify whether the supporting evidence actually justifies the claimed mapping.
+
+### Validation Criteria
+
+| Capability | Requirements | Validation Thresholds |
+|------------|-------------|----------------------|
+| **FULL** | Complete implementation within scope | ≥70% core requirements + ≥40% sub-elements |
+| **PARTIAL** | Limited scope with clear boundaries | ≥30% core requirements OR some core + ≥20% sub-elements |
+| **FACILITATES** | Enables/enhances implementation | Facilitation language present, no direct implementation claims |
+| **GOVERNANCE** | Policy/process management | ≥60% governance elements + policy language |
+| **VALIDATES** | Evidence collection & reporting | Audit/monitoring/reporting capabilities present |
+
+### Validation Statuses
+
+- **SUPPORTED** (70-100%): Evidence strongly supports the claimed capability
+- **QUESTIONABLE** (40-69%): Evidence partially supports but has notable gaps  
+- **UNSUPPORTED** (0-39%): Evidence does not adequately support the claim
+
+### Usage Examples
+
+```bash
+# Validate a FULL coverage claim
+claude-code "Use validate_vendor_mapping for vendor 'AssetMax Pro', safeguard '1.1', claimed capability 'full', with supporting text: 'Our platform provides comprehensive automated discovery, detailed inventory management, and complete asset lifecycle tracking for all enterprise devices including servers, workstations, and network equipment.'"
+
+# Validate a FACILITATES claim  
+claude-code "Use validate_vendor_mapping for vendor 'ThreatIntel Feed', safeguard '1.1', claimed capability 'facilitates', with supporting text: 'Our threat intelligence service provides supplemental risk data that enriches existing asset management systems, enabling organizations to prioritize asset security based on threat exposure.'"
+
+# Validate a questionable claim
+claude-code "Use validate_vendor_mapping for vendor 'BasicTracker', safeguard '1.1', claimed capability 'full', with supporting text: 'We help track computers and provide some visibility into your IT environment.'"
+```
+
 ## 🎯 CIS Controls Coverage
 
-Currently supports key safeguards including:
-- **1.1** - Enterprise Asset Inventory
-- **1.2** - Address Unauthorized Assets  
-- **5.1** - Inventory of Accounts
-- **6.3** - MFA for Externally-Exposed Applications
-- **7.1** - Vulnerability Management Process
+**Complete CIS Controls v8.1 Framework Implementation**
+- **153 total safeguards** across all 18 controls
+- **Full framework coverage** from Controls 1-18
+- **Comprehensive vendor analysis** capability for all CIS safeguards
 
-*Additional safeguards can be easily added to the framework.*
+### Current Version Highlights
+- ✅ **All 18 Controls** implemented (Enterprise Assets through Penetration Testing)
+- ✅ **Color-coded element categorization** (Orange/Green/Yellow/Gray)
+- ✅ **Enhanced capability detection** (Governance, Facilitates, Coverage, Validates)
+- ✅ **Production-ready** vendor analysis for complete compliance assessments
 
 ## 🛠️ Development
 

package/dist/index.d.ts

@@ -15,6 +15,17 @@ export declare class GRCAnalysisServer {
     private generateEnhancedReasoning;
     private generateCapabilityReasoning;
     private validateClaim;
+    private validateVendorMapping;
+    private validateCapabilityClaim;
+    private assessClaimAlignment;
+    private hasFacilitationLanguage;
+    private hasScopeBoundaries;
+    private hasDirectImplementationLanguage;
+    private assessImplementationLanguage;
+    private assessFacilitationLanguage;
+    private assessGovernanceLanguage;
+    private assessValidationLanguage;
+    private generateValidationFeedback;
     run(): Promise<void>;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAo5KA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;;IAavB,OAAO,CAAC,iBAAiB;YAkIX,mBAAmB;YA8CnB,uBAAuB;YAuCvB,qBAAqB;YAoBrB,qBAAqB;IA8BnC,OAAO,CAAC,gCAAgC;IAqJxC,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,2BAA2B;IAuEnC,OAAO,CAAC,aAAa;IAsFf,GAAG;CAKV"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAu6KA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;;IAavB,OAAO,CAAC,iBAAiB;YAiKX,mBAAmB;YA8CnB,uBAAuB;YAuCvB,qBAAqB;YAoBrB,qBAAqB;IA8BnC,OAAO,CAAC,gCAAgC;IAkKxC,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,2BAA2B;IAuEnC,OAAO,CAAC,aAAa;YAsFP,qBAAqB;IAyBnC,OAAO,CAAC,uBAAuB;IAqD/B,OAAO,CAAC,oBAAoB;IA4J5B,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,+BAA+B;IAQvC,OAAO,CAAC,4BAA4B;IAQpC,OAAO,CAAC,0BAA0B;IAQlC,OAAO,CAAC,wBAAwB;IAQhC,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,0BAA0B;IAiC5B,GAAG;CAKV"}

package/dist/index.js

@@ -5537,6 +5537,35 @@ export class GRCAnalysisServer {
                             }
                         }
                     }
+                },
+                {
+                    name: 'validate_vendor_mapping',
+                    description: 'Validate whether a vendor\'s stated capability mapping (Full/Partial/Facilitates/Governance/Validates) is actually supported by their explanatory text for a specific CIS safeguard',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            vendor_name: {
+                                type: 'string',
+                                description: 'Name of the vendor (optional)',
+                                default: 'Unknown Vendor'
+                            },
+                            safeguard_id: {
+                                type: 'string',
+                                description: 'CIS Control safeguard ID (e.g., "5.1", "1.1", "6.3")',
+                                pattern: '^[0-9]+\\.[0-9]+$'
+                            },
+                            claimed_capability: {
+                                type: 'string',
+                                enum: ['full', 'partial', 'facilitates', 'governance', 'validates'],
+                                description: 'Vendor\'s claimed capability mapping for this safeguard'
+                            },
+                            supporting_text: {
+                                type: 'string',
+                                description: 'Vendor\'s supporting text blob explaining how they meet the claimed capability'
+                            }
+                        },
+                        required: ['safeguard_id', 'claimed_capability', 'supporting_text']
+                    }
                 }
             ],
         }));
@@ -5552,6 +5581,8 @@ export class GRCAnalysisServer {
                         return await this.validateCoverageClaim(args);
                     case 'list_available_safeguards':
                         return await this.listAvailableSafeguards(args);
+                    case 'validate_vendor_mapping':
+                        return await this.validateVendorMapping(args);
                     default:
                         throw new Error(`Unknown tool: ${name}`);
                 }
@@ -5698,6 +5729,11 @@ export class GRCAnalysisServer {
             'improve', 'enhance', 'optimize', 'faster', 'better', 'stronger', 'automate',
             'streamline', 'efficiency', 'facilitate', 'support', 'enable', 'accelerate',
             'api', 'integration', 'data', 'export', 'import', 'sync', 'feed',
+            // Data provision and enrichment
+            'provides data', 'data source', 'data feeds', 'enrichment', 'data enrichment',
+            'supplemental data', 'additional data', 'contextual data', 'threat data',
+            'intelligence feeds', 'data aggregation', 'data collection', 'data gathering',
+            'feeds data', 'populates', 'informs', 'enriches', 'supplements',
             // Governance/process facilitation (new keywords for tools like Upolicy)
             'enables compliance', 'facilitates implementation', 'supports compliance',
             'creates framework', 'enables organizations', 'infrastructure', 'foundation',
@@ -5707,9 +5743,9 @@ export class GRCAnalysisServer {
         ];
         const validatesKeywords = [
             'audit', 'report', 'evidence', 'verify', 'validate', 'check', 'monitor',
-            'compliance report', 'assessment', 'logging', 'tracking', 'review', 'attest',
+            'compliance', 'compliance report', 'assessment', 'logging', 'tracking', 'review', 'attest',
             'dashboard', 'metrics', 'analytics', 'visibility', 'alert', 'attestation',
-            'compliance tracking', 'audit trail', 'reporting capabilities'
+            'compliance tracking', 'audit trail', 'reporting capabilities', 'audit capabilities'
         ];
         // Analyze element coverage (binary: covered or not)
         const coreCoverage = this.analyzeBinaryElementCoverage(text, safeguard.coreRequirements);
@@ -5739,18 +5775,22 @@ export class GRCAnalysisServer {
             'rather than direct', 'instead of direct'
         ];
         const hasNonImplementationLanguage = nonImplementationPatterns.some(pattern => text.includes(pattern));
-        // Determine if full or partial coverage (based on core + sub-taxonomical elements)
-        const totalCoreAndSubElements = safeguard.coreRequirements.length + safeguard.subTaxonomicalElements.length;
-        const coveredCoreAndSubElements = coreCoverage.coveredElements.length + subElementCoverage.coveredElements.length;
+        // Determine if full or partial coverage (based on core + sub-taxonomical elements WITHIN SCOPE)
+        // Full = addresses majority of core requirements + substantial sub-elements within their stated scope
+        // Partial = addresses some core requirements with clear scope boundaries
+        const corePercentage = safeguard.coreRequirements.length > 0 ?
+            (coreCoverage.coveredElements.length / safeguard.coreRequirements.length) * 100 : 0;
+        const subElementPercentage = safeguard.subTaxonomicalElements.length > 0 ?
+            (subElementCoverage.coveredElements.length / safeguard.subTaxonomicalElements.length) * 100 : 0;
         let fullCapability = false;
         let partialCapability = false;
-        if (totalCoreAndSubElements > 0) {
-            if (coveredCoreAndSubElements === totalCoreAndSubElements) {
-                fullCapability = true;
-            }
-            else if (coveredCoreAndSubElements > 0) {
-                partialCapability = true;
-            }
+        // Full capability: High coverage of core requirements + reasonable sub-element coverage
+        if (corePercentage >= 70 && subElementPercentage >= 50) {
+            fullCapability = true;
+        }
+        // Partial capability: Moderate core coverage OR clear scope-limited implementation
+        else if (corePercentage >= 30 || (coreCoverage.coveredElements.length > 0 && subElementPercentage >= 20)) {
+            partialCapability = true;
         }
         // Enhanced primary capability logic
         let primaryCapability = 'none';
@@ -5788,6 +5828,8 @@ export class GRCAnalysisServer {
         const evidence = this.extractEnhancedEvidence(responseText, safeguard);
         // Calculate confidence based on evidence strength and keyword matches
         const keywordConfidence = (governanceScore + facilitatesScore + validatesScore) / 3;
+        const totalCoreAndSubElements = safeguard.coreRequirements.length + safeguard.subTaxonomicalElements.length;
+        const coveredCoreAndSubElements = coreCoverage.coveredElements.length + subElementCoverage.coveredElements.length;
         const coverageConfidence = totalCoreAndSubElements > 0 ?
             coveredCoreAndSubElements / totalCoreAndSubElements : 0;
         const confidence = Math.min((keywordConfidence * 0.4 + coverageConfidence * 0.6) * 100, 100);
@@ -6074,6 +6116,264 @@ export class GRCAnalysisServer {
         }
         return validation;
     }
+    async validateVendorMapping(args) {
+        const { vendor_name = 'Unknown Vendor', safeguard_id, claimed_capability, supporting_text } = args;
+        const safeguard = CIS_SAFEGUARDS[safeguard_id];
+        if (!safeguard) {
+            throw new Error(`Safeguard ${safeguard_id} not found. Available safeguards: ${Object.keys(CIS_SAFEGUARDS).join(', ')}`);
+        }
+        const validation = this.validateCapabilityClaim(vendor_name, safeguard, claimed_capability, supporting_text);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify(validation, null, 2),
+                },
+            ],
+        };
+    }
+    validateCapabilityClaim(vendorName, safeguard, claimedCapability, supportingText) {
+        const text = supportingText.toLowerCase();
+        // Perform actual analysis of the supporting text
+        const actualAnalysis = this.performEnhancedSafeguardAnalysis(vendorName, safeguard, supportingText);
+        // Calculate coverage percentages
+        const coreCoverage = this.analyzeBinaryElementCoverage(text, safeguard.coreRequirements);
+        const subElementCoverage = this.analyzeBinaryElementCoverage(text, safeguard.subTaxonomicalElements);
+        const governanceCoverage = this.analyzeBinaryElementCoverage(text, safeguard.governanceElements);
+        const corePercentage = safeguard.coreRequirements.length > 0 ?
+            (coreCoverage.coveredElements.length / safeguard.coreRequirements.length) * 100 : 0;
+        const subElementPercentage = safeguard.subTaxonomicalElements.length > 0 ?
+            (subElementCoverage.coveredElements.length / safeguard.subTaxonomicalElements.length) * 100 : 0;
+        const governancePercentage = safeguard.governanceElements.length > 0 ?
+            (governanceCoverage.coveredElements.length / safeguard.governanceElements.length) * 100 : 0;
+        // Validate claim against criteria
+        const validation = this.assessClaimAlignment(claimedCapability, actualAnalysis, corePercentage, subElementPercentage, governancePercentage, text);
+        return {
+            vendor: vendorName,
+            safeguard_id: safeguard.id,
+            safeguard_title: safeguard.title,
+            claimed_capability: claimedCapability,
+            validation_status: validation.status,
+            confidence_score: validation.confidence,
+            evidence_analysis: {
+                core_requirements_coverage: Math.round(corePercentage),
+                sub_elements_coverage: Math.round(subElementPercentage),
+                governance_alignment: Math.round(governancePercentage),
+                language_consistency: validation.languageConsistency
+            },
+            gaps_identified: validation.gaps,
+            strengths_identified: validation.strengths,
+            recommendations: validation.recommendations,
+            detailed_feedback: validation.feedback
+        };
+    }
+    assessClaimAlignment(claimedCapability, actualAnalysis, corePercentage, subElementPercentage, governancePercentage, text) {
+        const gaps = [];
+        const strengths = [];
+        const recommendations = [];
+        let languageConsistency = 0;
+        let alignmentScore = 0;
+        switch (claimedCapability.toLowerCase()) {
+            case 'full':
+                // Validate FULL claim
+                if (corePercentage >= 70 && subElementPercentage >= 40) {
+                    alignmentScore = 85;
+                    strengths.push('High coverage of core requirements and sub-elements');
+                }
+                else if (corePercentage >= 80 && subElementPercentage >= 30) {
+                    // Alternative path: very high core with moderate sub-elements
+                    alignmentScore = 80;
+                    strengths.push('Very high core requirements coverage with adequate sub-element coverage');
+                }
+                else {
+                    alignmentScore = Math.max(0, (corePercentage + subElementPercentage) / 2 - 15);
+                    if (corePercentage < 70)
+                        gaps.push(`Core requirements coverage (${Math.round(corePercentage)}%) below FULL threshold (70%)`);
+                    if (subElementPercentage < 40)
+                        gaps.push(`Sub-element coverage (${Math.round(subElementPercentage)}%) below FULL threshold (40%)`);
+                }
+                // Check for conflicting facilitation language
+                if (this.hasFacilitationLanguage(text)) {
+                    alignmentScore -= 30;
+                    gaps.push('Contains facilitation language inconsistent with FULL implementation claim');
+                }
+                languageConsistency = this.assessImplementationLanguage(text);
+                break;
+            case 'partial':
+                // Validate PARTIAL claim
+                if (corePercentage >= 30 || (corePercentage > 0 && subElementPercentage >= 20)) {
+                    alignmentScore = 75;
+                    strengths.push('Appropriate coverage level for PARTIAL implementation');
+                }
+                else {
+                    alignmentScore = Math.max(0, corePercentage + subElementPercentage - 10);
+                    gaps.push(`Coverage too low even for PARTIAL claim: ${Math.round(corePercentage)}% core, ${Math.round(subElementPercentage)}% sub-elements`);
+                }
+                // Check for scope boundary definition
+                if (this.hasScopeBoundaries(text)) {
+                    strengths.push('Clearly defines scope boundaries and limitations');
+                    alignmentScore += 10;
+                }
+                else {
+                    gaps.push('Should clearly define scope boundaries for PARTIAL implementation');
+                    recommendations.push('Specify exactly which elements are covered and which are not');
+                }
+                languageConsistency = this.assessImplementationLanguage(text);
+                break;
+            case 'facilitates':
+                // Validate FACILITATES claim
+                if (this.hasFacilitationLanguage(text) || actualAnalysis.capabilities.facilitates) {
+                    alignmentScore = 80;
+                    strengths.push('Contains appropriate facilitation and enablement language');
+                }
+                else {
+                    alignmentScore = 40;
+                    gaps.push('Lacks clear facilitation language (enables, supports, provides framework)');
+                }
+                // Check that it doesn't claim direct implementation
+                if (this.hasDirectImplementationLanguage(text)) {
+                    // Special handling: If it lacks facilitation language AND claims implementation, stay QUESTIONABLE
+                    if (alignmentScore <= 40) {
+                        alignmentScore = 45; // Keep it in QUESTIONABLE range
+                    }
+                    else {
+                        alignmentScore -= 15;
+                    }
+                    gaps.push('Claims direct implementation, inconsistent with FACILITATES capability');
+                }
+                languageConsistency = this.assessFacilitationLanguage(text);
+                break;
+            case 'governance':
+                // Validate GOVERNANCE claim
+                if (governancePercentage >= 60 || actualAnalysis.capabilities.governance) {
+                    alignmentScore = 85;
+                    strengths.push('Strong governance element coverage and policy management language');
+                }
+                else {
+                    alignmentScore = Math.max(30, governancePercentage);
+                    gaps.push(`Governance element coverage (${Math.round(governancePercentage)}%) below expected threshold (60%)`);
+                }
+                languageConsistency = this.assessGovernanceLanguage(text);
+                break;
+            case 'validates':
+                // Validate VALIDATES claim
+                if (actualAnalysis.capabilities.validates) {
+                    alignmentScore = 85;
+                    strengths.push('Contains evidence collection and reporting capabilities');
+                }
+                else {
+                    alignmentScore = 30;
+                    gaps.push('Lacks validation language (audit, report, evidence, verify, monitor)');
+                }
+                languageConsistency = this.assessValidationLanguage(text);
+                break;
+            default:
+                alignmentScore = 0;
+                gaps.push(`Unknown capability type: ${claimedCapability}`);
+                languageConsistency = 0;
+        }
+        // Determine overall status
+        let status;
+        if (alignmentScore >= 70) {
+            status = 'SUPPORTED';
+        }
+        else if (alignmentScore >= 40) {
+            status = 'QUESTIONABLE';
+        }
+        else {
+            status = 'UNSUPPORTED';
+        }
+        // Generate recommendations
+        if (gaps.length > 0) {
+            recommendations.push('Address identified gaps to strengthen capability claim');
+        }
+        if (status === 'QUESTIONABLE') {
+            recommendations.push('Provide additional evidence or clarify scope to support claim');
+        }
+        const feedback = this.generateValidationFeedback(claimedCapability, status, gaps, strengths, alignmentScore);
+        return {
+            status,
+            confidence: Math.round(alignmentScore),
+            languageConsistency: Math.round(languageConsistency),
+            gaps,
+            strengths,
+            recommendations,
+            feedback
+        };
+    }
+    hasFacilitationLanguage(text) {
+        const facilitationPatterns = [
+            'enables', 'facilitates', 'supports', 'helps', 'provides framework',
+            'creates infrastructure', 'enables organizations', 'supports compliance',
+            'provides data', 'enriches', 'supplements', 'feeds data'
+        ];
+        return facilitationPatterns.some(pattern => text.includes(pattern));
+    }
+    hasScopeBoundaries(text) {
+        const boundaryPatterns = [
+            'covers', 'but not', 'limited to', 'specifically', 'only', 'excludes',
+            'scope includes', 'scope excludes', 'within', 'applies to'
+        ];
+        return boundaryPatterns.some(pattern => text.includes(pattern));
+    }
+    hasDirectImplementationLanguage(text) {
+        const implementationPatterns = [
+            'directly implements', 'performs', 'executes', 'scans', 'catalogs',
+            'inventories', 'manages assets', 'controls access', 'blocks threats'
+        ];
+        return implementationPatterns.some(pattern => text.includes(pattern));
+    }
+    assessImplementationLanguage(text) {
+        const implementationKeywords = [
+            'implements', 'performs', 'executes', 'manages', 'controls', 'maintains',
+            'establishes', 'configures', 'monitors', 'tracks', 'inventories'
+        ];
+        return this.calculateKeywordScore(text, implementationKeywords) * 100;
+    }
+    assessFacilitationLanguage(text) {
+        const facilitationKeywords = [
+            'enables', 'facilitates', 'supports', 'helps', 'enhances', 'improves',
+            'streamlines', 'automates', 'optimizes', 'provides framework'
+        ];
+        return this.calculateKeywordScore(text, facilitationKeywords) * 100;
+    }
+    assessGovernanceLanguage(text) {
+        const governanceKeywords = [
+            'policy', 'governance', 'compliance', 'oversight', 'management',
+            'framework', 'procedures', 'processes', 'controls', 'standards'
+        ];
+        return this.calculateKeywordScore(text, governanceKeywords) * 100;
+    }
+    assessValidationLanguage(text) {
+        const validationKeywords = [
+            'audit', 'validate', 'verify', 'report', 'evidence', 'monitor',
+            'assess', 'check', 'review', 'attest', 'compliance', 'compliance tracking',
+            'compliance reports', 'audit capabilities', 'audit trail', 'reporting capabilities'
+        ];
+        return this.calculateKeywordScore(text, validationKeywords) * 100;
+    }
+    generateValidationFeedback(claimedCapability, status, gaps, strengths, score) {
+        let feedback = `Validation of ${claimedCapability.toUpperCase()} capability claim: ${status} (${Math.round(score)}% alignment)\n\n`;
+        if (strengths.length > 0) {
+            feedback += `STRENGTHS:\n${strengths.map(s => `• ${s}`).join('\n')}\n\n`;
+        }
+        if (gaps.length > 0) {
+            feedback += `GAPS IDENTIFIED:\n${gaps.map(g => `• ${g}`).join('\n')}\n\n`;
+        }
+        feedback += `ASSESSMENT: `;
+        switch (status) {
+            case 'SUPPORTED':
+                feedback += 'The vendor\'s supporting evidence strongly aligns with their claimed capability.';
+                break;
+            case 'QUESTIONABLE':
+                feedback += 'The vendor\'s evidence partially supports their claim but has notable gaps or inconsistencies.';
+                break;
+            case 'UNSUPPORTED':
+                feedback += 'The vendor\'s evidence does not adequately support their claimed capability.';
+                break;
+        }
+        return feedback;
+    }
     async run() {
         const transport = new StdioServerTransport();
         await this.server.connect(transport);