framework-mcp 1.1.0 → 1.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "framework-mcp",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "MCP server for analyzing vendor responses against CIS Controls Framework using 4 GRC attributes (Governance, Facilitates, Coverage, Validates)",
   "main": "dist/index.js",
   "type": "module",

package/src/index.ts

@@ -84,6 +84,65 @@ interface AnalysisResult {
   recommendations: string[];
 }
 
+interface ValidationResult {
+  vendor: string;
+  safeguard_id: string;
+  safeguard_title: string;
+  claimed_capability: string;
+  validation_status: 'SUPPORTED' | 'QUESTIONABLE' | 'UNSUPPORTED';
+  confidence_score: number; // 0-100
+  evidence_analysis: {
+    core_requirements_coverage: number;
+    sub_elements_coverage: number;
+    governance_alignment: number;
+    language_consistency: number;
+  };
+  domain_validation: {
+    required_tool_type: string;
+    detected_tool_type: string;
+    domain_match: boolean;
+    capability_adjusted: boolean;
+    original_claim?: string;
+  };
+  gaps_identified: string[];
+  strengths_identified: string[];
+  recommendations: string[];
+  detailed_feedback: string;
+}
+
+// Domain-specific validation mapping
+const SAFEGUARD_DOMAIN_REQUIREMENTS: Record<string, {
+  domain: string;
+  required_tool_types: string[];
+  description: string;
+}> = {
+  "1.1": {
+    domain: "Asset Inventory",
+    required_tool_types: ["inventory", "asset_management", "cmdb", "discovery"],
+    description: "Only asset inventory and discovery tools can provide FULL/PARTIAL coverage"
+  },
+  "1.2": {
+    domain: "Asset Management", 
+    required_tool_types: ["inventory", "asset_management", "network_security", "nac"],
+    description: "Asset management or network access control tools required for FULL/PARTIAL"
+  },
+  "5.1": {
+    domain: "Account Management",
+    required_tool_types: ["identity_management", "iam", "directory", "account_management"],
+    description: "Identity and account management tools required for FULL/PARTIAL"
+  },
+  "6.3": {
+    domain: "Authentication",
+    required_tool_types: ["mfa", "authentication", "identity_management", "iam"],
+    description: "Multi-factor authentication and identity tools required for FULL/PARTIAL"
+  },
+  "7.1": {
+    domain: "Vulnerability Management",
+    required_tool_types: ["vulnerability_management", "vulnerability_scanner", "patch_management"],
+    description: "Vulnerability management and scanning tools required for FULL/PARTIAL"
+  }
+};
+
 // Enhanced CIS Controls Framework Data with color-coded categorization
 const CIS_SAFEGUARDS: Record<string, SafeguardElement> = {
   "1.1": {
@@ -5633,6 +5692,35 @@ export class GRCAnalysisServer {
               }
             }
           }
+        } as Tool,
+        {
+          name: 'validate_vendor_mapping',
+          description: 'Validate whether a vendor\'s stated capability mapping (Full/Partial/Facilitates/Governance/Validates) is actually supported by their explanatory text for a specific CIS safeguard',
+          inputSchema: {
+            type: 'object',
+            properties: {
+              vendor_name: {
+                type: 'string',
+                description: 'Name of the vendor (optional)',
+                default: 'Unknown Vendor'
+              },
+              safeguard_id: {
+                type: 'string',
+                description: 'CIS Control safeguard ID (e.g., "5.1", "1.1", "6.3")',
+                pattern: '^[0-9]+\\.[0-9]+$'
+              },
+              claimed_capability: {
+                type: 'string',
+                enum: ['full', 'partial', 'facilitates', 'governance', 'validates'],
+                description: 'Vendor\'s claimed capability mapping for this safeguard'
+              },
+              supporting_text: {
+                type: 'string',
+                description: 'Vendor\'s supporting text blob explaining how they meet the claimed capability'
+              }
+            },
+            required: ['safeguard_id', 'claimed_capability', 'supporting_text']
+          }
         } as Tool
       ],
     }));
@@ -5650,6 +5738,8 @@ export class GRCAnalysisServer {
             return await this.validateCoverageClaim(args);
           case 'list_available_safeguards':
             return await this.listAvailableSafeguards(args);
+          case 'validate_vendor_mapping':
+            return await this.validateVendorMapping(args);
           default:
             throw new Error(`Unknown tool: ${name}`);
         }
@@ -5817,6 +5907,11 @@ export class GRCAnalysisServer {
       'improve', 'enhance', 'optimize', 'faster', 'better', 'stronger', 'automate', 
       'streamline', 'efficiency', 'facilitate', 'support', 'enable', 'accelerate',
       'api', 'integration', 'data', 'export', 'import', 'sync', 'feed',
+      // Data provision and enrichment
+      'provides data', 'data source', 'data feeds', 'enrichment', 'data enrichment',
+      'supplemental data', 'additional data', 'contextual data', 'threat data',
+      'intelligence feeds', 'data aggregation', 'data collection', 'data gathering',
+      'feeds data', 'populates', 'informs', 'enriches', 'supplements',
       // Governance/process facilitation (new keywords for tools like Upolicy)
       'enables compliance', 'facilitates implementation', 'supports compliance',
       'creates framework', 'enables organizations', 'infrastructure', 'foundation',
@@ -5827,9 +5922,9 @@ export class GRCAnalysisServer {
     
     const validatesKeywords = [
       'audit', 'report', 'evidence', 'verify', 'validate', 'check', 'monitor', 
-      'compliance report', 'assessment', 'logging', 'tracking', 'review', 'attest',
+      'compliance', 'compliance report', 'assessment', 'logging', 'tracking', 'review', 'attest',
       'dashboard', 'metrics', 'analytics', 'visibility', 'alert', 'attestation',
-      'compliance tracking', 'audit trail', 'reporting capabilities'
+      'compliance tracking', 'audit trail', 'reporting capabilities', 'audit capabilities'
     ];
 
     // Analyze element coverage (binary: covered or not)
@@ -5865,19 +5960,25 @@ export class GRCAnalysisServer {
     ];
     const hasNonImplementationLanguage = nonImplementationPatterns.some(pattern => text.includes(pattern));
     
-    // Determine if full or partial coverage (based on core + sub-taxonomical elements)
-    const totalCoreAndSubElements = safeguard.coreRequirements.length + safeguard.subTaxonomicalElements.length;
-    const coveredCoreAndSubElements = coreCoverage.coveredElements.length + subElementCoverage.coveredElements.length;
+    // Determine if full or partial coverage (based on core + sub-taxonomical elements WITHIN SCOPE)
+    // Full = addresses majority of core requirements + substantial sub-elements within their stated scope
+    // Partial = addresses some core requirements with clear scope boundaries
+    
+    const corePercentage = safeguard.coreRequirements.length > 0 ? 
+      (coreCoverage.coveredElements.length / safeguard.coreRequirements.length) * 100 : 0;
+    const subElementPercentage = safeguard.subTaxonomicalElements.length > 0 ? 
+      (subElementCoverage.coveredElements.length / safeguard.subTaxonomicalElements.length) * 100 : 0;
     
     let fullCapability = false;
     let partialCapability = false;
     
-    if (totalCoreAndSubElements > 0) {
-      if (coveredCoreAndSubElements === totalCoreAndSubElements) {
-        fullCapability = true;
-      } else if (coveredCoreAndSubElements > 0) {
-        partialCapability = true;
-      }
+    // Full capability: High coverage of core requirements + reasonable sub-element coverage
+    if (corePercentage >= 70 && subElementPercentage >= 50) {
+      fullCapability = true;
+    }
+    // Partial capability: Moderate core coverage OR clear scope-limited implementation
+    else if (corePercentage >= 30 || (coreCoverage.coveredElements.length > 0 && subElementPercentage >= 20)) {
+      partialCapability = true;
     }
 
     // Enhanced primary capability logic
@@ -5914,6 +6015,8 @@ export class GRCAnalysisServer {
     // Calculate confidence based on evidence strength and keyword matches
     const keywordConfidence = (governanceScore + facilitatesScore + validatesScore) / 3;
     
+    const totalCoreAndSubElements = safeguard.coreRequirements.length + safeguard.subTaxonomicalElements.length;
+    const coveredCoreAndSubElements = coreCoverage.coveredElements.length + subElementCoverage.coveredElements.length;
     const coverageConfidence = totalCoreAndSubElements > 0 ? 
       coveredCoreAndSubElements / totalCoreAndSubElements : 0;
     
@@ -6262,6 +6365,473 @@ export class GRCAnalysisServer {
     return validation;
   }
 
+  private async validateVendorMapping(args: any) {
+    const { vendor_name = 'Unknown Vendor', safeguard_id, claimed_capability, supporting_text } = args;
+
+    const safeguard = CIS_SAFEGUARDS[safeguard_id];
+    if (!safeguard) {
+      throw new Error(`Safeguard ${safeguard_id} not found. Available safeguards: ${Object.keys(CIS_SAFEGUARDS).join(', ')}`);
+    }
+
+    const validation = this.validateCapabilityClaim(
+      vendor_name, 
+      safeguard, 
+      claimed_capability, 
+      supporting_text
+    );
+
+    return {
+      content: [
+        {
+          type: 'text',
+          text: JSON.stringify(validation, null, 2),
+        },
+      ],
+    };
+  }
+
+  private validateCapabilityClaim(
+    vendorName: string,
+    safeguard: SafeguardElement,
+    claimedCapability: string,
+    supportingText: string
+  ): ValidationResult {
+    const text = supportingText.toLowerCase();
+    
+    // Detect tool type and validate domain match
+    const detectedToolType = this.detectToolType(supportingText);
+    const domainValidation = this.validateDomainMatch(safeguard.id, claimedCapability, detectedToolType);
+    
+    // Adjust capability if domain mismatch detected
+    let effectiveCapability = claimedCapability;
+    let originalClaim: string | undefined;
+    
+    if (domainValidation.should_adjust_capability) {
+      originalClaim = claimedCapability;
+      effectiveCapability = domainValidation.adjusted_capability!;
+    }
+    
+    // Perform actual analysis of the supporting text
+    const actualAnalysis = this.performEnhancedSafeguardAnalysis(vendorName, safeguard, supportingText);
+    
+    // Calculate coverage percentages
+    const coreCoverage = this.analyzeBinaryElementCoverage(text, safeguard.coreRequirements);
+    const subElementCoverage = this.analyzeBinaryElementCoverage(text, safeguard.subTaxonomicalElements);
+    const governanceCoverage = this.analyzeBinaryElementCoverage(text, safeguard.governanceElements);
+    
+    const corePercentage = safeguard.coreRequirements.length > 0 ? 
+      (coreCoverage.coveredElements.length / safeguard.coreRequirements.length) * 100 : 0;
+    const subElementPercentage = safeguard.subTaxonomicalElements.length > 0 ? 
+      (subElementCoverage.coveredElements.length / safeguard.subTaxonomicalElements.length) * 100 : 0;
+    const governancePercentage = safeguard.governanceElements.length > 0 ? 
+      (governanceCoverage.coveredElements.length / safeguard.governanceElements.length) * 100 : 0;
+
+    // Validate claim against criteria (using effective capability after domain adjustment)
+    const validation = this.assessClaimAlignment(
+      effectiveCapability, 
+      actualAnalysis, 
+      corePercentage, 
+      subElementPercentage, 
+      governancePercentage,
+      text
+    );
+    
+    // Add domain validation gaps if capability was adjusted
+    if (domainValidation.should_adjust_capability) {
+      validation.gaps.unshift(`Domain mismatch: ${domainValidation.reasoning}`);
+      validation.recommendations.unshift(`Correct capability mapping should be '${effectiveCapability.toUpperCase()}' for ${detectedToolType} tools`);
+      // Reduce confidence for domain mismatches
+      validation.confidence = Math.max(validation.confidence - 20, 0);
+    }
+
+    return {
+      vendor: vendorName,
+      safeguard_id: safeguard.id,
+      safeguard_title: safeguard.title,
+      claimed_capability: claimedCapability,
+      validation_status: validation.status,
+      confidence_score: validation.confidence,
+      evidence_analysis: {
+        core_requirements_coverage: Math.round(corePercentage),
+        sub_elements_coverage: Math.round(subElementPercentage),
+        governance_alignment: Math.round(governancePercentage),
+        language_consistency: validation.languageConsistency
+      },
+      domain_validation: {
+        required_tool_type: domainValidation.required_tool_types.join('/'),
+        detected_tool_type: detectedToolType,
+        domain_match: domainValidation.domain_match,
+        capability_adjusted: domainValidation.should_adjust_capability,
+        original_claim: originalClaim
+      },
+      gaps_identified: validation.gaps,
+      strengths_identified: validation.strengths,
+      recommendations: validation.recommendations,
+      detailed_feedback: validation.feedback
+    };
+  }
+
+  private assessClaimAlignment(
+    claimedCapability: string,
+    actualAnalysis: VendorAnalysis,
+    corePercentage: number,
+    subElementPercentage: number,
+    governancePercentage: number,
+    text: string
+  ): {
+    status: 'SUPPORTED' | 'QUESTIONABLE' | 'UNSUPPORTED';
+    confidence: number;
+    languageConsistency: number;
+    gaps: string[];
+    strengths: string[];
+    recommendations: string[];
+    feedback: string;
+  } {
+    const gaps: string[] = [];
+    const strengths: string[] = [];
+    const recommendations: string[] = [];
+    let languageConsistency = 0;
+    let alignmentScore = 0;
+
+    switch (claimedCapability.toLowerCase()) {
+      case 'full':
+        // Validate FULL claim
+        if (corePercentage >= 70 && subElementPercentage >= 40) {
+          alignmentScore = 85;
+          strengths.push('High coverage of core requirements and sub-elements');
+        } else if (corePercentage >= 80 && subElementPercentage >= 30) {
+          // Alternative path: very high core with moderate sub-elements
+          alignmentScore = 80;
+          strengths.push('Very high core requirements coverage with adequate sub-element coverage');
+        } else {
+          alignmentScore = Math.max(0, (corePercentage + subElementPercentage) / 2 - 15);
+          if (corePercentage < 70) gaps.push(`Core requirements coverage (${Math.round(corePercentage)}%) below FULL threshold (70%)`);
+          if (subElementPercentage < 40) gaps.push(`Sub-element coverage (${Math.round(subElementPercentage)}%) below FULL threshold (40%)`);
+        }
+        
+        // Check for conflicting facilitation language
+        if (this.hasFacilitationLanguage(text)) {
+          alignmentScore -= 30;
+          gaps.push('Contains facilitation language inconsistent with FULL implementation claim');
+        }
+        
+        languageConsistency = this.assessImplementationLanguage(text);
+        break;
+
+      case 'partial':
+        // Validate PARTIAL claim
+        if (corePercentage >= 30 || (corePercentage > 0 && subElementPercentage >= 20)) {
+          alignmentScore = 75;
+          strengths.push('Appropriate coverage level for PARTIAL implementation');
+        } else {
+          alignmentScore = Math.max(0, corePercentage + subElementPercentage - 10);
+          gaps.push(`Coverage too low even for PARTIAL claim: ${Math.round(corePercentage)}% core, ${Math.round(subElementPercentage)}% sub-elements`);
+        }
+        
+        // Check for scope boundary definition
+        if (this.hasScopeBoundaries(text)) {
+          strengths.push('Clearly defines scope boundaries and limitations');
+          alignmentScore += 10;
+        } else {
+          gaps.push('Should clearly define scope boundaries for PARTIAL implementation');
+          recommendations.push('Specify exactly which elements are covered and which are not');
+        }
+        
+        languageConsistency = this.assessImplementationLanguage(text);
+        break;
+
+      case 'facilitates':
+        // Validate FACILITATES claim
+        if (this.hasFacilitationLanguage(text) || actualAnalysis.capabilities.facilitates) {
+          alignmentScore = 80;
+          strengths.push('Contains appropriate facilitation and enablement language');
+        } else {
+          alignmentScore = 40;
+          gaps.push('Lacks clear facilitation language (enables, supports, provides framework)');
+        }
+        
+        // Check that it doesn't claim direct implementation
+        if (this.hasDirectImplementationLanguage(text)) {
+          // Special handling: If it lacks facilitation language AND claims implementation, stay QUESTIONABLE
+          if (alignmentScore <= 40) {
+            alignmentScore = 45; // Keep it in QUESTIONABLE range
+          } else {
+            alignmentScore -= 15;
+          }
+          gaps.push('Claims direct implementation, inconsistent with FACILITATES capability');
+        }
+        
+        languageConsistency = this.assessFacilitationLanguage(text);
+        break;
+
+      case 'governance':
+        // Validate GOVERNANCE claim
+        if (governancePercentage >= 60 || actualAnalysis.capabilities.governance) {
+          alignmentScore = 85;
+          strengths.push('Strong governance element coverage and policy management language');
+        } else {
+          alignmentScore = Math.max(30, governancePercentage);
+          gaps.push(`Governance element coverage (${Math.round(governancePercentage)}%) below expected threshold (60%)`);
+        }
+        
+        languageConsistency = this.assessGovernanceLanguage(text);
+        break;
+
+      case 'validates':
+        // Validate VALIDATES claim
+        if (actualAnalysis.capabilities.validates) {
+          alignmentScore = 85;
+          strengths.push('Contains evidence collection and reporting capabilities');
+        } else {
+          alignmentScore = 30;
+          gaps.push('Lacks validation language (audit, report, evidence, verify, monitor)');
+        }
+        
+        languageConsistency = this.assessValidationLanguage(text);
+        break;
+
+      default:
+        alignmentScore = 0;
+        gaps.push(`Unknown capability type: ${claimedCapability}`);
+        languageConsistency = 0;
+    }
+
+    // Determine overall status
+    let status: 'SUPPORTED' | 'QUESTIONABLE' | 'UNSUPPORTED';
+    if (alignmentScore >= 70) {
+      status = 'SUPPORTED';
+    } else if (alignmentScore >= 40) {
+      status = 'QUESTIONABLE';
+    } else {
+      status = 'UNSUPPORTED';
+    }
+
+    // Generate recommendations
+    if (gaps.length > 0) {
+      recommendations.push('Address identified gaps to strengthen capability claim');
+    }
+    if (status === 'QUESTIONABLE') {
+      recommendations.push('Provide additional evidence or clarify scope to support claim');
+    }
+
+    const feedback = this.generateValidationFeedback(claimedCapability, status, gaps, strengths, alignmentScore);
+
+    return {
+      status,
+      confidence: Math.round(alignmentScore),
+      languageConsistency: Math.round(languageConsistency),
+      gaps,
+      strengths,
+      recommendations,
+      feedback
+    };
+  }
+
+  private hasFacilitationLanguage(text: string): boolean {
+    const facilitationPatterns = [
+      'enables', 'facilitates', 'supports', 'helps', 'provides framework',
+      'creates infrastructure', 'enables organizations', 'supports compliance',
+      'provides data', 'enriches', 'supplements', 'feeds data'
+    ];
+    return facilitationPatterns.some(pattern => text.includes(pattern));
+  }
+
+  private hasScopeBoundaries(text: string): boolean {
+    const boundaryPatterns = [
+      'covers', 'but not', 'limited to', 'specifically', 'only', 'excludes',
+      'scope includes', 'scope excludes', 'within', 'applies to'
+    ];
+    return boundaryPatterns.some(pattern => text.includes(pattern));
+  }
+
+  private hasDirectImplementationLanguage(text: string): boolean {
+    const implementationPatterns = [
+      'directly implements', 'performs', 'executes', 'scans', 'catalogs',
+      'inventories', 'manages assets', 'controls access', 'blocks threats'
+    ];
+    return implementationPatterns.some(pattern => text.includes(pattern));
+  }
+
+  private assessImplementationLanguage(text: string): number {
+    const implementationKeywords = [
+      'implements', 'performs', 'executes', 'manages', 'controls', 'maintains',
+      'establishes', 'configures', 'monitors', 'tracks', 'inventories'
+    ];
+    return this.calculateKeywordScore(text, implementationKeywords) * 100;
+  }
+
+  private assessFacilitationLanguage(text: string): number {
+    const facilitationKeywords = [
+      'enables', 'facilitates', 'supports', 'helps', 'enhances', 'improves',
+      'streamlines', 'automates', 'optimizes', 'provides framework'
+    ];
+    return this.calculateKeywordScore(text, facilitationKeywords) * 100;
+  }
+
+  private assessGovernanceLanguage(text: string): number {
+    const governanceKeywords = [
+      'policy', 'governance', 'compliance', 'oversight', 'management',
+      'framework', 'procedures', 'processes', 'controls', 'standards'
+    ];
+    return this.calculateKeywordScore(text, governanceKeywords) * 100;
+  }
+
+  private assessValidationLanguage(text: string): number {
+    const validationKeywords = [
+      'audit', 'validate', 'verify', 'report', 'evidence', 'monitor',
+      'assess', 'check', 'review', 'attest', 'compliance', 'compliance tracking',
+      'compliance reports', 'audit capabilities', 'audit trail', 'reporting capabilities'
+    ];
+    return this.calculateKeywordScore(text, validationKeywords) * 100;
+  }
+
+  private detectToolType(text: string): string {
+    const lowerText = text.toLowerCase();
+    
+    // Inventory/Asset Management tools
+    const inventoryKeywords = [
+      'asset management', 'inventory', 'cmdb', 'discovery', 'asset discovery',
+      'hardware inventory', 'software inventory', 'device inventory', 'asset tracking',
+      'configuration management database', 'it asset management', 'endpoint discovery'
+    ];
+    
+    // Identity/Authentication tools  
+    const identityKeywords = [
+      'identity management', 'iam', 'active directory', 'ldap', 'sso', 'single sign-on',
+      'mfa', 'multi-factor', 'authentication', 'identity provider', 'access management',
+      'user management', 'account management', 'directory service'
+    ];
+    
+    // Vulnerability Management tools
+    const vulnerabilityKeywords = [
+      'vulnerability scanner', 'vulnerability management', 'patch management', 
+      'security scanner', 'vuln scan', 'penetration test', 'security assessment',
+      'scanning capabilities', 'vulnerability scanning', 'network discovery'
+    ];
+    
+    // Network Security tools
+    const networkSecurityKeywords = [
+      'firewall', 'network access control', 'nac', 'network security', 'intrusion detection',
+      'network monitoring', 'traffic analysis', 'network segmentation'
+    ];
+    
+    // Threat Intelligence/Data Enrichment tools
+    const threatIntelKeywords = [
+      'threat intelligence', 'threat intel', 'threat feed', 'security intelligence',
+      'enrichment', 'data feed', 'contextual data', 'risk intelligence', 
+      'cyber threat intelligence', 'ioc feed', 'threat data'
+    ];
+    
+    // GRC/Governance tools
+    const governanceKeywords = [
+      'grc', 'governance', 'compliance management', 'policy management',
+      'risk management', 'audit management', 'compliance platform'
+    ];
+    
+    // Security Analytics/SIEM tools
+    const analyticsKeywords = [
+      'siem', 'security analytics', 'log management', 'security monitoring',
+      'event correlation', 'security orchestration', 'soar'
+    ];
+    
+    // Check for tool type patterns - order by specificity (most specific first)
+    if (threatIntelKeywords.some(keyword => lowerText.includes(keyword))) {
+      return 'threat_intelligence';
+    } else if (vulnerabilityKeywords.some(keyword => lowerText.includes(keyword))) {
+      return 'vulnerability_management';
+    } else if (identityKeywords.some(keyword => lowerText.includes(keyword))) {
+      return 'identity_management';
+    } else if (networkSecurityKeywords.some(keyword => lowerText.includes(keyword))) {
+      return 'network_security';
+    } else if (governanceKeywords.some(keyword => lowerText.includes(keyword))) {
+      return 'governance';
+    } else if (analyticsKeywords.some(keyword => lowerText.includes(keyword))) {
+      return 'security_analytics';
+    } else if (inventoryKeywords.some(keyword => lowerText.includes(keyword))) {
+      return 'inventory';
+    }
+    
+    return 'unknown';
+  }
+
+  private validateDomainMatch(
+    safeguardId: string, 
+    claimedCapability: string, 
+    detectedToolType: string
+  ): {
+    domain_match: boolean;
+    required_tool_types: string[];
+    should_adjust_capability: boolean;
+    adjusted_capability?: string;
+    reasoning: string;
+  } {
+    const domainReq = SAFEGUARD_DOMAIN_REQUIREMENTS[safeguardId];
+    
+    if (!domainReq) {
+      return {
+        domain_match: true,
+        required_tool_types: [],
+        should_adjust_capability: false,
+        reasoning: 'No domain restrictions defined for this safeguard'
+      };
+    }
+    
+    const isFullOrPartial = ['full', 'partial'].includes(claimedCapability.toLowerCase());
+    const toolTypeMatches = domainReq.required_tool_types.includes(detectedToolType);
+    
+    if (isFullOrPartial && !toolTypeMatches) {
+      return {
+        domain_match: false,
+        required_tool_types: domainReq.required_tool_types,
+        should_adjust_capability: true,
+        adjusted_capability: 'facilitates',
+        reasoning: `${domainReq.domain} safeguard requires ${domainReq.required_tool_types.join('/')} tool types for FULL/PARTIAL coverage. Detected tool type '${detectedToolType}' can only facilitate implementation.`
+      };
+    }
+    
+    return {
+      domain_match: true,
+      required_tool_types: domainReq.required_tool_types,
+      should_adjust_capability: false,
+      reasoning: toolTypeMatches ? 
+        `Tool type '${detectedToolType}' is appropriate for ${domainReq.domain} safeguard` :
+        'No domain validation required for this capability type'
+    };
+  }
+
+  private generateValidationFeedback(
+    claimedCapability: string,
+    status: string,
+    gaps: string[],
+    strengths: string[],
+    score: number
+  ): string {
+    let feedback = `Validation of ${claimedCapability.toUpperCase()} capability claim: ${status} (${Math.round(score)}% alignment)\n\n`;
+    
+    if (strengths.length > 0) {
+      feedback += `STRENGTHS:\n${strengths.map(s => `• ${s}`).join('\n')}\n\n`;
+    }
+    
+    if (gaps.length > 0) {
+      feedback += `GAPS IDENTIFIED:\n${gaps.map(g => `• ${g}`).join('\n')}\n\n`;
+    }
+    
+    feedback += `ASSESSMENT: `;
+    switch (status) {
+      case 'SUPPORTED':
+        feedback += 'The vendor\'s supporting evidence strongly aligns with their claimed capability.';
+        break;
+      case 'QUESTIONABLE':
+        feedback += 'The vendor\'s evidence partially supports their claim but has notable gaps or inconsistencies.';
+        break;
+      case 'UNSUPPORTED':
+        feedback += 'The vendor\'s evidence does not adequately support their claimed capability.';
+        break;
+    }
+    
+    return feedback;
+  }
+
   async run() {
     const transport = new StdioServerTransport();
     await this.server.connect(transport);