framework-mcp 1.1.0 → 1.1.2

package/README.md

@@ -44,6 +44,17 @@ The server uses the CIS Controls visual framework with color-coded categorizatio
 npm install -g framework-mcp
 ```
 
+### Update to Latest Version
+```bash
+npm update -g framework-mcp
+```
+
+Or reinstall to get the latest version:
+```bash
+npm uninstall -g framework-mcp
+npm install -g framework-mcp
+```
+
 ### Install from source
 ```bash
 git clone https://github.com/therealcybermattlee/FrameworkMCP.git
@@ -115,8 +126,21 @@ claude-code "Analyze the vendor responses in vendors.csv and provide recommendat
 claude-code "Show me the detailed breakdown of safeguard 5.1 including all sub-elements"
 ```
 
+### Validate Vendor Capability Claims
+
+**NEW**: Validate whether a vendor's stated capability mapping is actually supported by their explanatory text.
+
+```bash
+claude-code "Validate this vendor capability claim:
+Vendor: SecureAssets Corp
+Safeguard: 1.1  
+Claimed Capability: FULL
+Supporting Text: 'Our comprehensive asset management platform performs automated discovery of all enterprise devices, maintains detailed hardware and software inventories, tracks ownership and location data, provides real-time asset status monitoring, and includes documented inventory procedures with bi-annual review capabilities.'"
+```
+
 ## 📊 Sample Output
 
+### Standard Analysis Output
 ```json
 {
   "vendor": "SecureIAM Corp",
@@ -146,16 +170,82 @@ claude-code "Show me the detailed breakdown of safeguard 5.1 including all sub-e
 }
 ```
 
+### Validation Tool Output
+```json
+{
+  "vendor": "SecureAssets Corp",
+  "safeguard_id": "1.1",
+  "safeguard_title": "Establish and Maintain a Detailed Enterprise Asset Inventory",
+  "claimed_capability": "full",
+  "validation_status": "SUPPORTED",
+  "confidence_score": 85,
+  "evidence_analysis": {
+    "core_requirements_coverage": 100,
+    "sub_elements_coverage": 47,
+    "governance_alignment": 80,
+    "language_consistency": 90
+  },
+  "domain_validation": {
+    "required_tool_type": "inventory",
+    "detected_tool_type": "inventory",
+    "domain_match": true,
+    "capability_adjusted": false
+  },
+  "gaps_identified": [],
+  "strengths_identified": [
+    "High coverage of core requirements and sub-elements",
+    "Strong implementation language consistency",
+    "Appropriate tool type for safeguard domain"
+  ],
+  "recommendations": [],
+  "detailed_feedback": "Validation of FULL capability claim: SUPPORTED (85% alignment)\n\nSTRENGTHS:\n• High coverage of core requirements and sub-elements\n• Strong implementation language consistency\n• Appropriate tool type for safeguard domain\n\nASSESSMENT: The vendor's supporting evidence strongly aligns with their claimed capability."
+}
+```
+
+### Domain Mismatch Example Output
+```json
+{
+  "vendor": "ThreatIntel Pro",
+  "safeguard_id": "1.1", 
+  "safeguard_title": "Establish and Maintain a Detailed Enterprise Asset Inventory",
+  "claimed_capability": "facilitates",
+  "validation_status": "QUESTIONABLE",
+  "confidence_score": 45,
+  "evidence_analysis": {
+    "core_requirements_coverage": 65,
+    "sub_elements_coverage": 20,
+    "governance_alignment": 30,
+    "language_consistency": 75
+  },
+  "domain_validation": {
+    "required_tool_type": "inventory",
+    "detected_tool_type": "threat_intelligence", 
+    "domain_match": false,
+    "capability_adjusted": true,
+    "original_claim": "full"
+  },
+  "gaps_identified": [
+    "Tool type mismatch: threat_intelligence tools cannot provide FULL coverage for Asset Inventory safeguards"
+  ],
+  "strengths_identified": [
+    "Good language consistency in supporting text"
+  ],
+  "recommendations": [
+    "Consider repositioning as FACILITATES capability to align with tool type"
+  ],
+  "detailed_feedback": "DOMAIN VALIDATION: Tool type 'threat_intelligence' cannot provide FULL coverage for safeguard 1.1 (Asset Inventory). Capability automatically adjusted from FULL to FACILITATES.\n\nThe vendor's claim has been downgraded due to domain mismatch, though evidence quality is reasonable for facilitation capabilities."
+}
+```
+
 ## 🔧 Available Tools
 
 | Tool | Description |
 |------|-------------|
 | `analyze_vendor_response` | Analyze vendor response for specific safeguard |
+| `validate_vendor_mapping` | **NEW** Validate vendor's claimed capability against supporting evidence |
 | `validate_coverage_claim` | Validate FULL/PARTIAL coverage claims |
 | `get_safeguard_details` | Get detailed safeguard breakdown |
 | `list_available_safeguards` | List all available CIS safeguards |
-| `generate_coverage_report` | Generate detailed coverage analysis |
-| `export_analysis` | Export results to JSON/CSV/Markdown |
 
 ## 📁 File Formats Supported
 
@@ -185,16 +275,72 @@ Vendor: AnotherVendor - Safeguard: 6.3
 Another response...
 ```
 
+## 🆕 Vendor Mapping Validation
+
+The **validate_vendor_mapping** tool provides evidence-based validation of vendor capability claims. This addresses a critical need: vendors often self-assess their capabilities, but practitioners need to verify whether the supporting evidence actually justifies the claimed mapping.
+
+### Validation Criteria
+
+| Capability | Requirements | Validation Thresholds |
+|------------|-------------|----------------------|
+| **FULL** | Complete implementation within scope | ≥70% core requirements + ≥40% sub-elements |
+| **PARTIAL** | Limited scope with clear boundaries | ≥30% core requirements OR some core + ≥20% sub-elements |
+| **FACILITATES** | Enables/enhances implementation | Facilitation language present, no direct implementation claims |
+| **GOVERNANCE** | Policy/process management | ≥60% governance elements + policy language |
+| **VALIDATES** | Evidence collection & reporting | Audit/monitoring/reporting capabilities present |
+
+### Domain-Specific Validation Rules
+
+**CRITICAL**: The validation tool enforces domain-specific requirements for capability claims:
+
+| Safeguard | Domain | Required Tool Types | Rule |
+|-----------|--------|-------------------|------|
+| **1.1** | Asset Inventory | inventory, asset_management, cmdb, discovery | Only inventory tools can claim FULL/PARTIAL |
+| **1.2** | Unauthorized Assets | inventory, asset_management, cmdb, discovery | Only inventory tools can claim FULL/PARTIAL |
+| **5.1** | Account Inventory | identity_management, governance | Only identity/governance tools can claim FULL/PARTIAL |
+| **6.3** | External MFA | identity_management | Only identity management tools can claim FULL/PARTIAL |
+| **7.1** | Vulnerability Process | vulnerability_management, governance | Only vulnerability/governance tools can claim FULL/PARTIAL |
+
+**Auto-Downgrade Logic**: When a tool type doesn't match the safeguard domain:
+- **FULL/PARTIAL** claims → Automatically downgraded to **FACILITATES**
+- **FACILITATES/GOVERNANCE/VALIDATES** claims → Remain unchanged
+- Validation status becomes **QUESTIONABLE** with explanation
+
+### Validation Statuses
+
+- **SUPPORTED** (70-100%): Evidence strongly supports the claimed capability
+- **QUESTIONABLE** (40-69%): Evidence partially supports but has notable gaps OR domain mismatch occurred
+- **UNSUPPORTED** (0-39%): Evidence does not adequately support the claim
+
+### Usage Examples
+
+```bash
+# Validate a FULL coverage claim (matching domain)
+claude-code "Use validate_vendor_mapping for vendor 'AssetMax Pro', safeguard '1.1', claimed capability 'full', with supporting text: 'Our platform provides comprehensive automated discovery, detailed inventory management, and complete asset lifecycle tracking for all enterprise devices including servers, workstations, and network equipment.'"
+
+# Validate a FACILITATES claim  
+claude-code "Use validate_vendor_mapping for vendor 'ThreatIntel Feed', safeguard '1.1', claimed capability 'facilitates', with supporting text: 'Our threat intelligence service provides supplemental risk data that enriches existing asset management systems, enabling organizations to prioritize asset security based on threat exposure.'"
+
+# Domain mismatch example (auto-downgraded)
+claude-code "Use validate_vendor_mapping for vendor 'VulnScanner Pro', safeguard '1.1', claimed capability 'full', with supporting text: 'Our vulnerability scanner performs comprehensive network discovery and maintains detailed device databases with complete visibility into enterprise infrastructure.'"
+# Result: Downgraded from FULL to FACILITATES (vulnerability_management ≠ inventory tool)
+
+# Questionable claim (insufficient evidence)
+claude-code "Use validate_vendor_mapping for vendor 'BasicTracker', safeguard '1.1', claimed capability 'full', with supporting text: 'We help track computers and provide some visibility into your IT environment.'"
+```
+
 ## 🎯 CIS Controls Coverage
 
-Currently supports key safeguards including:
-- **1.1** - Enterprise Asset Inventory
-- **1.2** - Address Unauthorized Assets  
-- **5.1** - Inventory of Accounts
-- **6.3** - MFA for Externally-Exposed Applications
-- **7.1** - Vulnerability Management Process
+**Complete CIS Controls v8.1 Framework Implementation**
+- **153 total safeguards** across all 18 controls
+- **Full framework coverage** from Controls 1-18
+- **Comprehensive vendor analysis** capability for all CIS safeguards
 
-*Additional safeguards can be easily added to the framework.*
+### Current Version Highlights
+- ✅ **All 18 Controls** implemented (Enterprise Assets through Penetration Testing)
+- ✅ **Color-coded element categorization** (Orange/Green/Yellow/Gray)
+- ✅ **Enhanced capability detection** (Governance, Facilitates, Coverage, Validates)
+- ✅ **Production-ready** vendor analysis for complete compliance assessments
 
 ## 🛠️ Development
 

package/dist/index.d.ts

@@ -15,6 +15,19 @@ export declare class GRCAnalysisServer {
     private generateEnhancedReasoning;
     private generateCapabilityReasoning;
     private validateClaim;
+    private validateVendorMapping;
+    private validateCapabilityClaim;
+    private assessClaimAlignment;
+    private hasFacilitationLanguage;
+    private hasScopeBoundaries;
+    private hasDirectImplementationLanguage;
+    private assessImplementationLanguage;
+    private assessFacilitationLanguage;
+    private assessGovernanceLanguage;
+    private assessValidationLanguage;
+    private detectToolType;
+    private validateDomainMatch;
+    private generateValidationFeedback;
     run(): Promise<void>;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAo5KA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;;IAavB,OAAO,CAAC,iBAAiB;YAkIX,mBAAmB;YA8CnB,uBAAuB;YAuCvB,qBAAqB;YAoBrB,qBAAqB;IA8BnC,OAAO,CAAC,gCAAgC;IAqJxC,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,2BAA2B;IAuEnC,OAAO,CAAC,aAAa;IAsFf,GAAG;CAKV"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA+8KA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;;IAavB,OAAO,CAAC,iBAAiB;YAiKX,mBAAmB;YA8CnB,uBAAuB;YAuCvB,qBAAqB;YAoBrB,qBAAqB;IA8BnC,OAAO,CAAC,gCAAgC;IAkKxC,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,2BAA2B;IAuEnC,OAAO,CAAC,aAAa;YAsFP,qBAAqB;IAyBnC,OAAO,CAAC,uBAAuB;IAiF/B,OAAO,CAAC,oBAAoB;IA4J5B,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,+BAA+B;IAQvC,OAAO,CAAC,4BAA4B;IAQpC,OAAO,CAAC,0BAA0B;IAQlC,OAAO,CAAC,wBAAwB;IAQhC,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,cAAc;IAqEtB,OAAO,CAAC,mBAAmB;IA6C3B,OAAO,CAAC,0BAA0B;IAiC5B,GAAG;CAKV"}