framework-mcp 1.1.2 → 1.2.0

package/dist/index.js

@@ -1,4 +1,17 @@
 #!/usr/bin/env node
+// Re-export the MCP server for backward compatibility
+import { FrameworkMcpServer } from './interfaces/mcp/mcp-server.js';
+// Start MCP server if this file is run directly
+if (import.meta.url === `file://${process.argv[1]}`) {
+    const server = new FrameworkMcpServer();
+    server.run().catch(console.error);
+}
+export { FrameworkMcpServer } from './interfaces/mcp/mcp-server.js';
+export { FrameworkHttpServer } from './interfaces/http/http-server.js';
+export { CapabilityAnalyzer } from './core/capability-analyzer.js';
+export { SafeguardManager } from './core/safeguard-manager.js';
+// Legacy compatibility - keep the original massive implementation for reference
+// This will be removed in a future version once migration is complete
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
@@ -7,27 +20,27 @@ const SAFEGUARD_DOMAIN_REQUIREMENTS = {
     "1.1": {
         domain: "Asset Inventory",
         required_tool_types: ["inventory", "asset_management", "cmdb", "discovery"],
-        description: "Only asset inventory and discovery tools can provide FULL/PARTIAL coverage"
+        description: "Only asset inventory and discovery tools can provide FULL/PARTIAL implementation capability"
     },
     "1.2": {
         domain: "Asset Management",
         required_tool_types: ["inventory", "asset_management", "network_security", "nac"],
-        description: "Asset management or network access control tools required for FULL/PARTIAL"
+        description: "Asset management or network access control tools required for FULL/PARTIAL implementation capability"
     },
     "5.1": {
         domain: "Account Management",
         required_tool_types: ["identity_management", "iam", "directory", "account_management"],
-        description: "Identity and account management tools required for FULL/PARTIAL"
+        description: "Identity and account management tools required for FULL/PARTIAL implementation capability"
     },
     "6.3": {
         domain: "Authentication",
         required_tool_types: ["mfa", "authentication", "identity_management", "iam"],
-        description: "Multi-factor authentication and identity tools required for FULL/PARTIAL"
+        description: "Multi-factor authentication and identity tools required for FULL/PARTIAL implementation capability"
     },
     "7.1": {
         domain: "Vulnerability Management",
         required_tool_types: ["vulnerability_management", "vulnerability_scanner", "patch_management"],
-        description: "Vulnerability management and scanning tools required for FULL/PARTIAL"
+        description: "Vulnerability management and scanning tools required for FULL/PARTIAL implementation capability"
     }
 };
 // Enhanced CIS Controls Framework Data with color-coded categorization
@@ -5462,6 +5475,19 @@ const CIS_SAFEGUARDS = {
 };
 export class GRCAnalysisServer {
     constructor() {
+        // Performance monitoring and caching
+        this.performanceMetrics = {
+            toolExecutionTimes: new Map(),
+            startTime: Date.now(),
+            totalRequests: 0,
+            errorCount: 0
+        };
+        // Simple cache for safeguard details (most commonly requested data)
+        this.cache = {
+            safeguardDetails: new Map(),
+            safeguardList: null,
+            lastCacheCleanup: Date.now()
+        };
         this.server = new Server({
             name: 'framework-mcp',
             version: '1.0.0',
@@ -5473,7 +5499,7 @@ export class GRCAnalysisServer {
             tools: [
                 {
                     name: 'analyze_vendor_response',
-                    description: 'Analyze a vendor response for a specific CIS Control safeguard against the 4 GRC attributes with detailed sub-element coverage',
+                    description: 'Analyze a vendor response to determine their tool capability role (Full Implementation, Partial Implementation, Facilitates, Governance, or Validates) for a specific CIS Control safeguard',
                     inputSchema: {
                         type: 'object',
                         properties: {
@@ -5488,7 +5514,7 @@ export class GRCAnalysisServer {
                             },
                             response_text: {
                                 type: 'string',
-                                description: 'Vendor response text to analyze'
+                                description: 'Vendor response text describing their tool capabilities for the safeguard'
                             }
                         },
                         required: ['vendor_name', 'safeguard_id', 'response_text']
@@ -5516,7 +5542,7 @@ export class GRCAnalysisServer {
                 },
                 {
                     name: 'validate_coverage_claim',
-                    description: 'Validate a vendor\'s coverage claim (FULL/PARTIAL) against specific safeguard requirements',
+                    description: 'Validate a vendor\'s implementation capability claim (FULL/PARTIAL) against specific safeguard requirements and evidence quality',
                     inputSchema: {
                         type: 'object',
                         properties: {
@@ -5532,16 +5558,16 @@ export class GRCAnalysisServer {
                             coverage_claim: {
                                 type: 'string',
                                 enum: ['FULL', 'PARTIAL'],
-                                description: 'Vendor\'s coverage claim'
+                                description: 'Vendor\'s implementation capability claim (FULL = complete implementation, PARTIAL = limited scope implementation)'
                             },
                             response_text: {
                                 type: 'string',
-                                description: 'Vendor response explaining their coverage'
+                                description: 'Vendor response explaining their implementation capabilities'
                             },
                             capabilities: {
                                 type: 'array',
                                 items: { type: 'string' },
-                                description: 'List of vendor capabilities/attributes (Governance, Facilitates, Validates)'
+                                description: 'List of additional vendor capability types (Governance, Facilitates, Validates)'
                             }
                         },
                         required: ['vendor_name', 'safeguard_id', 'coverage_claim', 'response_text', 'capabilities']
@@ -5568,7 +5594,7 @@ export class GRCAnalysisServer {
                 },
                 {
                     name: 'validate_vendor_mapping',
-                    description: 'Validate whether a vendor\'s stated capability mapping (Full/Partial/Facilitates/Governance/Validates) is actually supported by their explanatory text for a specific CIS safeguard',
+                    description: 'Validate whether a vendor\'s claimed capability role (Full Implementation/Partial Implementation/Facilitates/Governance/Validates) is actually supported by their supporting evidence for a specific CIS safeguard',
                     inputSchema: {
                         type: 'object',
                         properties: {
@@ -5585,11 +5611,11 @@ export class GRCAnalysisServer {
                             claimed_capability: {
                                 type: 'string',
                                 enum: ['full', 'partial', 'facilitates', 'governance', 'validates'],
-                                description: 'Vendor\'s claimed capability mapping for this safeguard'
+                                description: 'Vendor\'s claimed capability role: full (complete implementation), partial (limited implementation), facilitates (enables/enhances), governance (policies/processes), validates (evidence/reporting)'
                             },
                             supporting_text: {
                                 type: 'string',
-                                description: 'Vendor\'s supporting text blob explaining how they meet the claimed capability'
+                                description: 'Vendor\'s supporting evidence explaining how their tool fulfills the claimed capability role'
                             }
                         },
                         required: ['safeguard_id', 'claimed_capability', 'supporting_text']
@@ -5599,28 +5625,45 @@ export class GRCAnalysisServer {
         }));
         this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const { name, arguments: args } = request.params;
+            const startTime = Date.now();
             try {
+                let result;
                 switch (name) {
                     case 'analyze_vendor_response':
-                        return await this.analyzeVendorResponse(args);
+                        result = await this.analyzeVendorResponse(args);
+                        break;
                     case 'get_safeguard_details':
-                        return await this.getSafeguardDetails(args);
+                        result = await this.getSafeguardDetails(args);
+                        break;
                     case 'validate_coverage_claim':
-                        return await this.validateCoverageClaim(args);
+                        result = await this.validateCoverageClaim(args);
+                        break;
                     case 'list_available_safeguards':
-                        return await this.listAvailableSafeguards(args);
+                        result = await this.listAvailableSafeguards(args);
+                        break;
                     case 'validate_vendor_mapping':
-                        return await this.validateVendorMapping(args);
+                        result = await this.validateVendorMapping(args);
+                        break;
                     default:
                         throw new Error(`Unknown tool: ${name}`);
                 }
+                // Record successful execution time
+                const executionTime = Date.now() - startTime;
+                this.recordToolExecution(name, executionTime);
+                return result;
             }
             catch (error) {
+                // Record error and performance metrics
+                this.performanceMetrics.errorCount++;
+                const executionTime = Date.now() - startTime;
+                this.recordToolExecution(`${name}_error`, executionTime);
+                const errorMessage = this.formatErrorMessage(error, name);
+                console.error(`[FrameworkMCP] Tool execution error: ${name}`, error);
                 return {
                     content: [
                         {
                             type: 'text',
-                            text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                            text: errorMessage,
                         },
                     ],
                 };
@@ -5629,10 +5672,14 @@ export class GRCAnalysisServer {
     }
     async getSafeguardDetails(args) {
         const { safeguard_id, include_examples = true } = args;
-        const safeguard = CIS_SAFEGUARDS[safeguard_id];
-        if (!safeguard) {
-            throw new Error(`Safeguard ${safeguard_id} not found. Use list_available_safeguards to see available safeguards.`);
+        // Input validation
+        this.validateSafeguardId(safeguard_id);
+        // Check cache first
+        const cached = this.getCachedSafeguardDetails(safeguard_id, include_examples);
+        if (cached) {
+            return cached;
         }
+        const safeguard = CIS_SAFEGUARDS[safeguard_id];
         const result = {
             ...safeguard,
             elementBreakdown: {
@@ -5660,7 +5707,7 @@ export class GRCAnalysisServer {
                 })
             }
         };
-        return {
+        const response = {
             content: [
                 {
                     type: 'text',
@@ -5668,9 +5715,19 @@ export class GRCAnalysisServer {
                 },
             ],
         };
+        // Cache the result for future requests
+        this.setCachedSafeguardDetails(safeguard_id, include_examples, response);
+        return response;
     }
     async listAvailableSafeguards(args) {
         const { implementation_group, security_function } = args;
+        // Check cache for complete safeguard list (only if no filters applied)
+        if (!implementation_group && !security_function && this.cache.safeguardList) {
+            const cacheAge = Date.now() - this.cache.safeguardList.timestamp;
+            if (cacheAge < 10 * 60 * 1000) { // 10 minute cache for safeguard list
+                return this.cache.safeguardList.data;
+            }
+        }
         let safeguards = Object.values(CIS_SAFEGUARDS);
         if (implementation_group) {
             safeguards = safeguards.filter(s => s.implementationGroup === implementation_group);
@@ -5693,7 +5750,7 @@ export class GRCAnalysisServer {
                 securityFunction: s.securityFunction
             }))
         };
-        return {
+        const response = {
             content: [
                 {
                     type: 'text',
@@ -5701,14 +5758,25 @@ export class GRCAnalysisServer {
                 },
             ],
         };
+        // Cache the complete list if no filters were applied
+        if (!implementation_group && !security_function) {
+            this.cache.safeguardList = {
+                data: response,
+                timestamp: Date.now()
+            };
+        }
+        return response;
     }
     async analyzeVendorResponse(args) {
         const { vendor_name, safeguard_id, response_text } = args;
-        const safeguard = CIS_SAFEGUARDS[safeguard_id];
-        if (!safeguard) {
-            throw new Error(`Safeguard ${safeguard_id} not found. Available safeguards: ${Object.keys(CIS_SAFEGUARDS).join(', ')}`);
+        // Input validation
+        this.validateSafeguardId(safeguard_id);
+        this.validateTextInput(response_text, 'Response text');
+        if (!vendor_name || typeof vendor_name !== 'string' || vendor_name.trim().length === 0) {
+            throw new Error('Vendor name is required');
         }
-        const analysis = this.performEnhancedSafeguardAnalysis(vendor_name, safeguard, response_text);
+        const safeguard = CIS_SAFEGUARDS[safeguard_id];
+        const analysis = this.performCapabilityAnalysis(vendor_name, safeguard, response_text);
         return {
             content: [
                 {
@@ -5724,7 +5792,7 @@ export class GRCAnalysisServer {
         if (!safeguard) {
             throw new Error(`Safeguard ${safeguard_id} not found`);
         }
-        const analysis = this.performEnhancedSafeguardAnalysis(vendor_name, safeguard, response_text);
+        const analysis = this.performCapabilityAnalysis(vendor_name, safeguard, response_text);
         // Validate the coverage claim
         const validation = this.validateClaim(coverage_claim, analysis, capabilities, safeguard);
         return {
@@ -5743,163 +5811,242 @@ export class GRCAnalysisServer {
             ],
         };
     }
-    performEnhancedSafeguardAnalysis(vendorName, safeguard, responseText) {
+    performCapabilityAnalysis(vendorName, safeguard, responseText) {
         const text = responseText.toLowerCase();
-        // Capability detection keywords
-        const governanceKeywords = [
+        // Step 1: Determine what type of capability this tool is claiming
+        const claimedCapability = this.determineClaimedCapability(text, safeguard);
+        // Step 2: Assess how well the tool executes that specific capability type  
+        const qualityAssessment = this.assessCapabilityQuality(text, safeguard, claimedCapability);
+        // Step 3: Generate capability-focused analysis
+        return this.generateCapabilityAnalysis(vendorName, safeguard, responseText, claimedCapability, qualityAssessment);
+    }
+    determineClaimedCapability(text, safeguard) {
+        // Capability detection keywords - focused on what the tool DOES, not what elements it covers
+        const governanceIndicators = [
             'policy', 'policies', 'manage', 'process', 'workflow', 'governance', 'grc',
             'compliance management', 'documented', 'establish', 'maintain', 'procedure',
             'control', 'controls', 'framework', 'standard', 'enterprise risk management',
             'centralized management', 'oversight'
         ];
-        const facilitatesKeywords = [
-            // Technical facilitation (original keywords)
+        const facilitatesIndicators = [
             'improve', 'enhance', 'optimize', 'faster', 'better', 'stronger', 'automate',
             'streamline', 'efficiency', 'facilitate', 'support', 'enable', 'accelerate',
             'api', 'integration', 'data', 'export', 'import', 'sync', 'feed',
-            // Data provision and enrichment
             'provides data', 'data source', 'data feeds', 'enrichment', 'data enrichment',
             'supplemental data', 'additional data', 'contextual data', 'threat data',
             'intelligence feeds', 'data aggregation', 'data collection', 'data gathering',
             'feeds data', 'populates', 'informs', 'enriches', 'supplements',
-            // Governance/process facilitation (new keywords for tools like Upolicy)
             'enables compliance', 'facilitates implementation', 'supports compliance',
             'creates framework', 'enables organizations', 'infrastructure', 'foundation',
-            'compliance infrastructure', 'audit infrastructure', 'policy framework',
-            'enables effective', 'working together', 'comprehensive coverage',
             'template', 'templates', 'workflow automation', 'orchestration'
         ];
-        const validatesKeywords = [
+        const validatesIndicators = [
             'audit', 'report', 'evidence', 'verify', 'validate', 'check', 'monitor',
             'compliance', 'compliance report', 'assessment', 'logging', 'tracking', 'review', 'attest',
             'dashboard', 'metrics', 'analytics', 'visibility', 'alert', 'attestation',
             'compliance tracking', 'audit trail', 'reporting capabilities', 'audit capabilities'
         ];
-        // Analyze element coverage (binary: covered or not)
-        const coreCoverage = this.analyzeBinaryElementCoverage(text, safeguard.coreRequirements);
-        const subElementCoverage = this.analyzeBinaryElementCoverage(text, safeguard.subTaxonomicalElements);
-        const governanceCoverage = this.analyzeBinaryElementCoverage(text, safeguard.governanceElements);
-        const implementationCoverage = this.analyzeBinaryElementCoverage(text, safeguard.implementationSuggestions);
-        // Enhanced capability detection with better scoring
-        const governanceScore = this.calculateKeywordScore(text, governanceKeywords);
-        const facilitatesScore = this.calculateKeywordScore(text, facilitatesKeywords);
-        const validatesScore = this.calculateKeywordScore(text, validatesKeywords);
-        const governanceCapability = governanceScore > 0.3;
-        const facilitatesCapability = facilitatesScore > 0.3;
-        const validatesCapability = validatesScore > 0.3;
-        // Check for specific facilitation patterns (tools that enable/support compliance)
-        const facilitationPatterns = [
-            'enables compliance', 'facilitates implementation', 'creates framework',
-            'policy framework', 'compliance infrastructure', 'audit infrastructure',
-            'enables organizations', 'enables effective', 'working together',
-            'creates the policy framework', 'enables organizations to implement',
-            'facilitates implementation of', 'compliance infrastructure facilitates'
-        ];
-        const hasFacilitationPattern = facilitationPatterns.some(pattern => text.includes(pattern));
-        // Check for explicit non-implementation language
-        const nonImplementationPatterns = [
-            'don\'t scan', 'don\'t catalog', 'doesn\'t scan', 'doesn\'t catalog',
-            'not scan', 'not catalog', 'even though we don\'t', 'we don\'t directly',
-            'rather than direct', 'instead of direct'
-        ];
-        const hasNonImplementationLanguage = nonImplementationPatterns.some(pattern => text.includes(pattern));
-        // Determine if full or partial coverage (based on core + sub-taxonomical elements WITHIN SCOPE)
-        // Full = addresses majority of core requirements + substantial sub-elements within their stated scope
-        // Partial = addresses some core requirements with clear scope boundaries
-        const corePercentage = safeguard.coreRequirements.length > 0 ?
-            (coreCoverage.coveredElements.length / safeguard.coreRequirements.length) * 100 : 0;
-        const subElementPercentage = safeguard.subTaxonomicalElements.length > 0 ?
-            (subElementCoverage.coveredElements.length / safeguard.subTaxonomicalElements.length) * 100 : 0;
-        let fullCapability = false;
-        let partialCapability = false;
-        // Full capability: High coverage of core requirements + reasonable sub-element coverage
-        if (corePercentage >= 70 && subElementPercentage >= 50) {
-            fullCapability = true;
+        // Direct implementation indicators (tools that actually perform the safeguard)
+        const implementationIndicators = this.getImplementationIndicators(safeguard.id);
+        // Calculate keyword presence scores
+        const governanceScore = this.calculateKeywordScore(text, governanceIndicators);
+        const facilitatesScore = this.calculateKeywordScore(text, facilitatesIndicators);
+        const validatesScore = this.calculateKeywordScore(text, validatesIndicators);
+        const implementationScore = this.calculateKeywordScore(text, implementationIndicators);
+        // Determine claimed capability based on strongest indicators and patterns
+        if (implementationScore > 0.2 && implementationScore >= Math.max(facilitatesScore, governanceScore, validatesScore)) {
+            // Tool claims to directly implement the safeguard
+            return implementationScore > 0.5 ? 'full' : 'partial';
         }
-        // Partial capability: Moderate core coverage OR clear scope-limited implementation
-        else if (corePercentage >= 30 || (coreCoverage.coveredElements.length > 0 && subElementPercentage >= 20)) {
-            partialCapability = true;
+        else if (governanceScore > 0.2 && governanceScore >= Math.max(facilitatesScore, validatesScore)) {
+            return 'governance';
         }
-        // Enhanced primary capability logic
-        let primaryCapability = 'none';
-        if (fullCapability) {
-            primaryCapability = 'full';
+        else if (validatesScore > 0.2 && validatesScore >= facilitatesScore) {
+            return 'validates';
         }
-        else if (hasFacilitationPattern || hasNonImplementationLanguage ||
-            (facilitatesScore > 0.4 && facilitatesScore > governanceScore * 1.2)) {
-            // Prioritize facilitation when:
-            // 1. Clear facilitation language patterns detected, OR
-            // 2. Explicit non-implementation language (tool doesn't directly implement), OR  
-            // 3. Facilitates score is substantial AND significantly higher than governance
-            primaryCapability = 'facilitates';
+        else {
+            return 'facilitates';
         }
-        else if (partialCapability) {
-            primaryCapability = 'partial';
+    }
+    getImplementationIndicators(safeguardId) {
+        // Return specific indicators for what constitutes direct implementation for each safeguard
+        const implementationMap = {
+            "1.1": ['inventory', 'discovery', 'asset management', 'catalog', 'enumerate', 'scan devices', 'device database'],
+            "1.2": ['unauthorized', 'rogue', 'detect', 'identify unauthorized', 'quarantine', 'block unauthorized'],
+            "5.1": ['account inventory', 'user management', 'identity management', 'account lifecycle', 'user provisioning'],
+            "6.3": ['multi-factor', 'mfa', '2fa', 'authentication', 'two-factor', 'multi-factor authentication'],
+            "7.1": ['vulnerability', 'vuln', 'scanning', 'vulnerability management', 'security testing', 'penetration testing']
+        };
+        return implementationMap[safeguardId] || [];
+    }
+    assessCapabilityQuality(text, safeguard, claimedCapability) {
+        // Assess how well the tool executes the claimed capability type
+        const evidence = [];
+        const gaps = [];
+        // Quality assessment based on capability type
+        let qualityScore = 0;
+        switch (claimedCapability) {
+            case 'full':
+            case 'partial':
+                qualityScore = this.assessImplementationQuality(text, safeguard, evidence, gaps);
+                break;
+            case 'governance':
+                qualityScore = this.assessGovernanceQuality(text, safeguard, evidence, gaps);
+                break;
+            case 'facilitates':
+                qualityScore = this.assessFacilitationQuality(text, safeguard, evidence, gaps);
+                break;
+            case 'validates':
+                qualityScore = this.assessValidationQuality(text, safeguard, evidence, gaps);
+                break;
         }
-        else if (governanceCapability && (facilitatesCapability || validatesCapability)) {
-            // Tools that primarily manage governance but also facilitate/validate
-            primaryCapability = 'governance';
+        // Convert score to quality rating
+        let quality;
+        if (qualityScore >= 0.8)
+            quality = 'excellent';
+        else if (qualityScore >= 0.6)
+            quality = 'good';
+        else if (qualityScore >= 0.4)
+            quality = 'fair';
+        else
+            quality = 'poor';
+        return {
+            quality,
+            confidence: Math.round(qualityScore * 100),
+            evidence: evidence.slice(0, 5), // Top 5 pieces of evidence
+            gaps: gaps.slice(0, 3) // Top 3 gaps identified
+        };
+    }
+    assessImplementationQuality(text, safeguard, evidence, gaps) {
+        // Assess quality of direct implementation capability
+        const implementationIndicators = this.getImplementationIndicators(safeguard.id);
+        let score = 0;
+        // Check for strong implementation language
+        const strongIndicators = implementationIndicators.filter(indicator => text.includes(indicator.toLowerCase()));
+        if (strongIndicators.length > 0) {
+            score += 0.4;
+            evidence.push(`Strong implementation indicators: ${strongIndicators.join(', ')}`);
+        }
+        // Check for comprehensive functionality description
+        if (text.includes('comprehensive') || text.includes('complete') || text.includes('full')) {
+            score += 0.2;
+            evidence.push('Claims comprehensive functionality');
+        }
+        // Check for automated vs manual implementation
+        if (text.includes('automat') || text.includes('real-time') || text.includes('continuous')) {
+            score += 0.2;
+            evidence.push('Automated implementation capability');
         }
-        else if (governanceScore > facilitatesScore && governanceCapability) {
-            // Pure governance tools
-            primaryCapability = 'governance';
+        // Identify potential gaps
+        if (strongIndicators.length === 0) {
+            gaps.push('No clear implementation indicators found');
         }
-        else if (validatesScore > facilitatesScore && validatesCapability) {
-            // Validation-focused tools
-            primaryCapability = 'validates';
+        return Math.min(score, 1.0);
+    }
+    assessGovernanceQuality(text, safeguard, evidence, gaps) {
+        const governanceIndicators = ['policy', 'process', 'governance', 'compliance', 'documentation', 'oversight'];
+        let score = 0;
+        const foundIndicators = governanceIndicators.filter(indicator => text.includes(indicator));
+        if (foundIndicators.length >= 3) {
+            score += 0.5;
+            evidence.push(`Strong governance capability: ${foundIndicators.join(', ')}`);
+        }
+        if (text.includes('documented') && text.includes('process')) {
+            score += 0.3;
+            evidence.push('Documented process management');
+        }
+        return Math.min(score, 1.0);
+    }
+    assessFacilitationQuality(text, safeguard, evidence, gaps) {
+        const facilitationIndicators = ['enhance', 'enable', 'support', 'facilitate', 'improve', 'optimize'];
+        let score = 0;
+        const foundIndicators = facilitationIndicators.filter(indicator => text.includes(indicator));
+        if (foundIndicators.length >= 2) {
+            score += 0.4;
+            evidence.push(`Clear facilitation capability: ${foundIndicators.join(', ')}`);
         }
-        else if (facilitatesCapability) {
-            // Default facilitation
-            primaryCapability = 'facilitates';
+        return Math.min(score, 1.0);
+    }
+    assessValidationQuality(text, safeguard, evidence, gaps) {
+        const validationIndicators = ['audit', 'report', 'monitor', 'track', 'verify', 'validate'];
+        let score = 0;
+        const foundIndicators = validationIndicators.filter(indicator => text.includes(indicator));
+        if (foundIndicators.length >= 2) {
+            score += 0.4;
+            evidence.push(`Strong validation capability: ${foundIndicators.join(', ')}`);
         }
-        // Extract evidence
-        const evidence = this.extractEnhancedEvidence(responseText, safeguard);
-        // Calculate confidence based on evidence strength and keyword matches
-        const keywordConfidence = (governanceScore + facilitatesScore + validatesScore) / 3;
-        const totalCoreAndSubElements = safeguard.coreRequirements.length + safeguard.subTaxonomicalElements.length;
-        const coveredCoreAndSubElements = coreCoverage.coveredElements.length + subElementCoverage.coveredElements.length;
-        const coverageConfidence = totalCoreAndSubElements > 0 ?
-            coveredCoreAndSubElements / totalCoreAndSubElements : 0;
-        const confidence = Math.min((keywordConfidence * 0.4 + coverageConfidence * 0.6) * 100, 100);
+        return Math.min(score, 1.0);
+    }
+    generateCapabilityAnalysis(vendorName, safeguard, responseText, claimedCapability, qualityAssessment) {
+        // Generate the new capability-focused analysis result
         return {
             vendor: vendorName,
             safeguardId: safeguard.id,
             safeguardTitle: safeguard.title,
-            capability: primaryCapability,
+            capability: claimedCapability,
             capabilities: {
-                full: fullCapability,
-                partial: partialCapability,
-                facilitates: facilitatesCapability,
-                governance: governanceCapability,
-                validates: validatesCapability
-            },
-            confidence: Math.round(confidence),
-            reasoning: this.generateCapabilityReasoning(primaryCapability, fullCapability, partialCapability, governanceCapability, facilitatesCapability, validatesCapability, coreCoverage, subElementCoverage, safeguard, hasFacilitationPattern, hasNonImplementationLanguage),
-            evidence,
-            elementsCovered: {
-                coreRequirements: coreCoverage.coveredElements,
-                subTaxonomicalElements: subElementCoverage.coveredElements,
-                governanceElements: governanceCoverage.coveredElements,
-                implementationMethods: implementationCoverage.coveredElements
+                full: claimedCapability === 'full',
+                partial: claimedCapability === 'partial',
+                facilitates: claimedCapability === 'facilitates',
+                governance: claimedCapability === 'governance',
+                validates: claimedCapability === 'validates'
             },
-            elementsNotCovered: {
-                coreRequirements: coreCoverage.uncoveredElements,
-                subTaxonomicalElements: subElementCoverage.uncoveredElements
-            }
+            confidence: qualityAssessment.confidence,
+            reasoning: this.generateCapabilityReasoning(claimedCapability, qualityAssessment, safeguard),
+            evidence: qualityAssessment.evidence,
+            // Note: elementsCovered is now less relevant in capability-focused analysis
+            // We focus on tool capability rather than element coverage
+            toolCapabilityDescription: this.generateToolCapabilityDescription(claimedCapability, qualityAssessment),
+            recommendedUse: this.generateRecommendedUse(claimedCapability, safeguard)
+        };
+    }
+    generateCapabilityReasoning(claimedCapability, qualityAssessment, safeguard) {
+        const capabilityDescriptions = {
+            full: "directly implements the core functionality of this safeguard",
+            partial: "implements limited aspects of this safeguard with clear scope boundaries",
+            facilitates: "enhances or enables the implementation of this safeguard by others",
+            governance: "provides governance, policy, and oversight capabilities for this safeguard",
+            validates: "provides evidence, audit, and compliance validation for this safeguard"
+        };
+        const qualityDescriptor = qualityAssessment.quality;
+        const description = capabilityDescriptions[claimedCapability];
+        return `This tool ${description} with ${qualityDescriptor} capability quality. ${qualityAssessment.evidence.length > 0 ? 'Evidence: ' + qualityAssessment.evidence.join('; ') : ''}`;
+    }
+    generateToolCapabilityDescription(claimedCapability, qualityAssessment) {
+        const roleDescriptions = {
+            full: "Core Implementation Tool - Directly performs the safeguard functionality",
+            partial: "Focused Implementation Tool - Performs specific aspects of the safeguard",
+            facilitates: "Enablement Tool - Helps organizations implement the safeguard more effectively",
+            governance: "Governance Tool - Manages policies, processes, and oversight for the safeguard",
+            validates: "Compliance Tool - Provides audit, evidence, and validation capabilities"
+        };
+        return roleDescriptions[claimedCapability] || "Support Tool";
+    }
+    generateRecommendedUse(claimedCapability, safeguard) {
+        const recommendations = {
+            full: `Use as primary implementation tool for ${safeguard.title}. Ensure proper configuration and integration.`,
+            partial: `Use as part of a multi-tool strategy for ${safeguard.title}. Supplement with additional capabilities as needed.`,
+            facilitates: `Use to enhance existing safeguard implementation. Combine with direct implementation tools.`,
+            governance: `Use for policy management and governance oversight. Pair with implementation and validation tools.`,
+            validates: `Use for compliance monitoring and evidence collection. Combine with implementation tools for complete coverage.`
         };
+        return recommendations[claimedCapability] || "Evaluate specific use case alignment.";
     }
     calculateKeywordScore(text, keywords) {
-        let score = 0;
-        let matches = 0;
+        let matchedKeywords = 0;
+        let totalMatches = 0;
         keywords.forEach(keyword => {
             const regex = new RegExp(keyword.replace(/\s+/g, '\\s+'), 'gi');
             const keywordMatches = (text.match(regex) || []).length;
             if (keywordMatches > 0) {
-                matches++;
-                score += keywordMatches;
+                matchedKeywords++;
+                totalMatches += keywordMatches;
             }
         });
-        return matches > 0 ? score / text.split(' ').length : 0;
+        // Return percentage of keywords that were found, with bonus for multiple matches
+        const baseScore = matchedKeywords / keywords.length;
+        const matchBonus = Math.min(totalMatches * 0.1, 0.5); // Up to 50% bonus for multiple matches
+        return Math.min(baseScore + matchBonus, 1.0);
     }
     analyzeElementCoverage(text, elements) {
         const coveredElements = [];
@@ -6009,63 +6156,6 @@ export class GRCAnalysisServer {
         }
         return reasons.join('. ');
     }
-    generateCapabilityReasoning(primaryCapability, full, partial, governance, facilitates, validates, coreCoverage, subElementCoverage, safeguard, hasFacilitationPattern = false, hasNonImplementationLanguage = false) {
-        const reasons = [];
-        // Primary capability explanation
-        switch (primaryCapability) {
-            case 'full':
-                reasons.push(`Provides FULL coverage of ${safeguard.title} - directly implements all core and sub-taxonomical elements`);
-                break;
-            case 'partial':
-                reasons.push(`Provides PARTIAL coverage of ${safeguard.title} - directly implements some but not all core and sub-taxonomical elements`);
-                break;
-            case 'facilitates':
-                if (hasFacilitationPattern || hasNonImplementationLanguage || governance) {
-                    reasons.push(`FACILITATES ${safeguard.title} by creating governance frameworks, policy infrastructure, and compliance processes that enable organizations to implement the control effectively`);
-                }
-                else {
-                    reasons.push(`FACILITATES ${safeguard.title} through data integration, automation, or technical capabilities that support implementation`);
-                }
-                break;
-            case 'governance':
-                reasons.push(`Provides GOVERNANCE capabilities for ${safeguard.title} through centralized policy management, process controls, and compliance oversight`);
-                break;
-            case 'validates':
-                reasons.push(`VALIDATES ${safeguard.title} implementation through evidence collection, compliance reporting, and audit capabilities`);
-                break;
-            default:
-                reasons.push(`No clear capability identified for ${safeguard.title}`);
-        }
-        // Coverage details
-        if (coreCoverage.coveredElements.length > 0) {
-            reasons.push(`Core elements addressed: ${coreCoverage.coveredElements.length}/${safeguard.coreRequirements.length}`);
-        }
-        if (subElementCoverage.coveredElements.length > 0) {
-            reasons.push(`Sub-taxonomical elements addressed: ${subElementCoverage.coveredElements.length}/${safeguard.subTaxonomicalElements.length}`);
-        }
-        // Additional context for facilitation tools
-        if (primaryCapability === 'facilitates') {
-            if (hasFacilitationPattern || hasNonImplementationLanguage || governance) {
-                reasons.push(`Note: This type of facilitation tool works alongside technical implementation solutions (asset scanners, MDM tools, etc.) to provide comprehensive control coverage`);
-            }
-            if (hasNonImplementationLanguage) {
-                reasons.push(`Tool explicitly enables compliance through governance/process rather than direct technical implementation`);
-            }
-        }
-        // Multi-capability products
-        const capabilityFlags = [governance, facilitates, validates].filter(Boolean);
-        if (capabilityFlags.length > 1) {
-            const capabilities = [];
-            if (governance)
-                capabilities.push('governance');
-            if (facilitates)
-                capabilities.push('facilitates');
-            if (validates)
-                capabilities.push('validates');
-            reasons.push(`Multi-capability product with: ${capabilities.join(', ')}`);
-        }
-        return reasons.join('. ');
-    }
     validateClaim(claim, analysis, capabilities, safeguard) {
         const validation = {
             coverageClaimValid: false,
@@ -6078,16 +6168,14 @@ export class GRCAnalysisServer {
             const meetsFullCriteria = analysis.capabilities.full;
             validation.coverageClaimValid = meetsFullCriteria;
             if (!meetsFullCriteria) {
-                const totalElements = safeguard.coreRequirements.length + safeguard.subTaxonomicalElements.length;
-                const coveredElements = analysis.elementsCovered.coreRequirements.length + analysis.elementsCovered.subTaxonomicalElements.length;
-                validation.gaps.push(`FULL coverage claim not supported: Only ${coveredElements}/${totalElements} core and sub-taxonomical elements covered`);
+                validation.gaps.push(`FULL implementation capability claim not supported: Tool does not demonstrate direct implementation of core safeguard functionality`);
             }
         }
         else if (claim === 'PARTIAL') {
             const meetsPartialCriteria = analysis.capabilities.partial || analysis.capabilities.full;
             validation.coverageClaimValid = meetsPartialCriteria;
             if (!meetsPartialCriteria) {
-                validation.gaps.push(`PARTIAL coverage claim questionable: No core or sub-taxonomical elements clearly addressed`);
+                validation.gaps.push(`PARTIAL implementation capability claim questionable: No core or sub-taxonomical elements clearly addressed`);
             }
         }
         // Validate capability claims
@@ -6131,12 +6219,18 @@ export class GRCAnalysisServer {
         }
         else {
             validation.recommendations.push(`Consider requesting additional information about: ${validation.gaps.join(', ')}`);
-            // Specific recommendations based on gaps
-            if (analysis.elementsNotCovered.coreRequirements.length > 0) {
-                validation.recommendations.push(`Request details on how these core elements are addressed: ${analysis.elementsNotCovered.coreRequirements.slice(0, 3).join(', ')}${analysis.elementsNotCovered.coreRequirements.length > 3 ? '...' : ''}`);
+            // Capability-based recommendations
+            if (analysis.capability === 'facilitates') {
+                validation.recommendations.push('Consider pairing with direct implementation tools for complete safeguard coverage');
+            }
+            else if (analysis.capability === 'partial') {
+                validation.recommendations.push('Evaluate scope limitations and identify complementary tools for full coverage');
             }
-            if (analysis.elementsNotCovered.subTaxonomicalElements.length > 0) {
-                validation.recommendations.push(`Ask for specifics on these sub-taxonomical elements: ${analysis.elementsNotCovered.subTaxonomicalElements.slice(0, 3).join(', ')}${analysis.elementsNotCovered.subTaxonomicalElements.length > 3 ? '...' : ''}`);
+            else if (analysis.capability === 'governance') {
+                validation.recommendations.push('Combine with technical implementation tools for complete safeguard execution');
+            }
+            else if (analysis.capability === 'validates') {
+                validation.recommendations.push('Pair with implementation tools to ensure both execution and validation coverage');
             }
             if (!analysis.capabilities.validates && capabilities.includes('Validates')) {
                 validation.recommendations.push(`Request examples of audit trails, reporting capabilities, and compliance evidence`);
@@ -6146,10 +6240,11 @@ export class GRCAnalysisServer {
     }
     async validateVendorMapping(args) {
         const { vendor_name = 'Unknown Vendor', safeguard_id, claimed_capability, supporting_text } = args;
+        // Input validation
+        this.validateSafeguardId(safeguard_id);
+        this.validateTextInput(supporting_text, 'Supporting text');
+        this.validateCapability(claimed_capability);
         const safeguard = CIS_SAFEGUARDS[safeguard_id];
-        if (!safeguard) {
-            throw new Error(`Safeguard ${safeguard_id} not found. Available safeguards: ${Object.keys(CIS_SAFEGUARDS).join(', ')}`);
-        }
         const validation = this.validateCapabilityClaim(vendor_name, safeguard, claimed_capability, supporting_text);
         return {
             content: [
@@ -6163,7 +6258,7 @@ export class GRCAnalysisServer {
     validateCapabilityClaim(vendorName, safeguard, claimedCapability, supportingText) {
         const text = supportingText.toLowerCase();
         // Detect tool type and validate domain match
-        const detectedToolType = this.detectToolType(supportingText);
+        const detectedToolType = this.detectToolType(supportingText, safeguard.id);
         const domainValidation = this.validateDomainMatch(safeguard.id, claimedCapability, detectedToolType);
         // Adjust capability if domain mismatch detected
         let effectiveCapability = claimedCapability;
@@ -6172,20 +6267,10 @@ export class GRCAnalysisServer {
             originalClaim = claimedCapability;
             effectiveCapability = domainValidation.adjusted_capability;
         }
-        // Perform actual analysis of the supporting text
-        const actualAnalysis = this.performEnhancedSafeguardAnalysis(vendorName, safeguard, supportingText);
-        // Calculate coverage percentages
-        const coreCoverage = this.analyzeBinaryElementCoverage(text, safeguard.coreRequirements);
-        const subElementCoverage = this.analyzeBinaryElementCoverage(text, safeguard.subTaxonomicalElements);
-        const governanceCoverage = this.analyzeBinaryElementCoverage(text, safeguard.governanceElements);
-        const corePercentage = safeguard.coreRequirements.length > 0 ?
-            (coreCoverage.coveredElements.length / safeguard.coreRequirements.length) * 100 : 0;
-        const subElementPercentage = safeguard.subTaxonomicalElements.length > 0 ?
-            (subElementCoverage.coveredElements.length / safeguard.subTaxonomicalElements.length) * 100 : 0;
-        const governancePercentage = safeguard.governanceElements.length > 0 ?
-            (governanceCoverage.coveredElements.length / safeguard.governanceElements.length) * 100 : 0;
-        // Validate claim against criteria (using effective capability after domain adjustment)
-        const validation = this.assessClaimAlignment(effectiveCapability, actualAnalysis, corePercentage, subElementPercentage, governancePercentage, text);
+        // Perform capability-focused analysis of the supporting text
+        const actualAnalysis = this.performCapabilityAnalysis(vendorName, safeguard, supportingText);
+        // Validate claimed capability against actual capability analysis and domain requirements
+        const validation = this.assessCapabilityClaimAlignment(claimedCapability, effectiveCapability, actualAnalysis, domainValidation, text);
         // Add domain validation gaps if capability was adjusted
         if (domainValidation.should_adjust_capability) {
             validation.gaps.unshift(`Domain mismatch: ${domainValidation.reasoning}`);
@@ -6200,12 +6285,10 @@ export class GRCAnalysisServer {
             claimed_capability: claimedCapability,
             validation_status: validation.status,
             confidence_score: validation.confidence,
-            evidence_analysis: {
-                core_requirements_coverage: Math.round(corePercentage),
-                sub_elements_coverage: Math.round(subElementPercentage),
-                governance_alignment: Math.round(governancePercentage),
-                language_consistency: validation.languageConsistency
-            },
+            actual_capability_detected: actualAnalysis.capability,
+            capability_confidence: actualAnalysis.confidence,
+            tool_capability_description: actualAnalysis.toolCapabilityDescription,
+            recommended_use: actualAnalysis.recommendedUse,
             domain_validation: {
                 required_tool_type: domainValidation.required_tool_types.join('/'),
                 detected_tool_type: detectedToolType,
@@ -6219,112 +6302,42 @@ export class GRCAnalysisServer {
             detailed_feedback: validation.feedback
         };
     }
-    assessClaimAlignment(claimedCapability, actualAnalysis, corePercentage, subElementPercentage, governancePercentage, text) {
+    assessCapabilityClaimAlignment(claimedCapability, effectiveCapability, actualAnalysis, domainValidation, text) {
         const gaps = [];
         const strengths = [];
         const recommendations = [];
-        let languageConsistency = 0;
+        // Compare claimed capability with what we actually detected
+        const claimedLower = claimedCapability.toLowerCase();
+        const effectiveLower = effectiveCapability.toLowerCase();
+        const actualCapability = actualAnalysis.capability;
         let alignmentScore = 0;
-        switch (claimedCapability.toLowerCase()) {
-            case 'full':
-                // Validate FULL claim
-                if (corePercentage >= 70 && subElementPercentage >= 40) {
-                    alignmentScore = 85;
-                    strengths.push('High coverage of core requirements and sub-elements');
-                }
-                else if (corePercentage >= 80 && subElementPercentage >= 30) {
-                    // Alternative path: very high core with moderate sub-elements
-                    alignmentScore = 80;
-                    strengths.push('Very high core requirements coverage with adequate sub-element coverage');
-                }
-                else {
-                    alignmentScore = Math.max(0, (corePercentage + subElementPercentage) / 2 - 15);
-                    if (corePercentage < 70)
-                        gaps.push(`Core requirements coverage (${Math.round(corePercentage)}%) below FULL threshold (70%)`);
-                    if (subElementPercentage < 40)
-                        gaps.push(`Sub-element coverage (${Math.round(subElementPercentage)}%) below FULL threshold (40%)`);
-                }
-                // Check for conflicting facilitation language
-                if (this.hasFacilitationLanguage(text)) {
-                    alignmentScore -= 30;
-                    gaps.push('Contains facilitation language inconsistent with FULL implementation claim');
-                }
-                languageConsistency = this.assessImplementationLanguage(text);
-                break;
-            case 'partial':
-                // Validate PARTIAL claim
-                if (corePercentage >= 30 || (corePercentage > 0 && subElementPercentage >= 20)) {
-                    alignmentScore = 75;
-                    strengths.push('Appropriate coverage level for PARTIAL implementation');
-                }
-                else {
-                    alignmentScore = Math.max(0, corePercentage + subElementPercentage - 10);
-                    gaps.push(`Coverage too low even for PARTIAL claim: ${Math.round(corePercentage)}% core, ${Math.round(subElementPercentage)}% sub-elements`);
-                }
-                // Check for scope boundary definition
-                if (this.hasScopeBoundaries(text)) {
-                    strengths.push('Clearly defines scope boundaries and limitations');
-                    alignmentScore += 10;
-                }
-                else {
-                    gaps.push('Should clearly define scope boundaries for PARTIAL implementation');
-                    recommendations.push('Specify exactly which elements are covered and which are not');
-                }
-                languageConsistency = this.assessImplementationLanguage(text);
-                break;
-            case 'facilitates':
-                // Validate FACILITATES claim
-                if (this.hasFacilitationLanguage(text) || actualAnalysis.capabilities.facilitates) {
-                    alignmentScore = 80;
-                    strengths.push('Contains appropriate facilitation and enablement language');
-                }
-                else {
-                    alignmentScore = 40;
-                    gaps.push('Lacks clear facilitation language (enables, supports, provides framework)');
-                }
-                // Check that it doesn't claim direct implementation
-                if (this.hasDirectImplementationLanguage(text)) {
-                    // Special handling: If it lacks facilitation language AND claims implementation, stay QUESTIONABLE
-                    if (alignmentScore <= 40) {
-                        alignmentScore = 45; // Keep it in QUESTIONABLE range
-                    }
-                    else {
-                        alignmentScore -= 15;
-                    }
-                    gaps.push('Claims direct implementation, inconsistent with FACILITATES capability');
-                }
-                languageConsistency = this.assessFacilitationLanguage(text);
-                break;
-            case 'governance':
-                // Validate GOVERNANCE claim
-                if (governancePercentage >= 60 || actualAnalysis.capabilities.governance) {
-                    alignmentScore = 85;
-                    strengths.push('Strong governance element coverage and policy management language');
-                }
-                else {
-                    alignmentScore = Math.max(30, governancePercentage);
-                    gaps.push(`Governance element coverage (${Math.round(governancePercentage)}%) below expected threshold (60%)`);
-                }
-                languageConsistency = this.assessGovernanceLanguage(text);
-                break;
-            case 'validates':
-                // Validate VALIDATES claim
-                if (actualAnalysis.capabilities.validates) {
-                    alignmentScore = 85;
-                    strengths.push('Contains evidence collection and reporting capabilities');
-                }
-                else {
-                    alignmentScore = 30;
-                    gaps.push('Lacks validation language (audit, report, evidence, verify, monitor)');
-                }
-                languageConsistency = this.assessValidationLanguage(text);
-                break;
-            default:
-                alignmentScore = 0;
-                gaps.push(`Unknown capability type: ${claimedCapability}`);
-                languageConsistency = 0;
+        // Check if claim aligns with actual analysis
+        if (claimedLower === actualCapability) {
+            alignmentScore = actualAnalysis.confidence;
+            strengths.push(`Claimed capability '${claimedCapability}' aligns with detected capability`);
+            strengths.push(`Tool demonstrates appropriate ${actualAnalysis.toolCapabilityDescription.toLowerCase()}`);
+        }
+        else if (effectiveLower === actualCapability) {
+            // Domain validation adjusted the capability and it matches the analysis
+            alignmentScore = Math.max(actualAnalysis.confidence - 20, 30);
+            gaps.push(`Original claim '${claimedCapability}' doesn't match tool type, adjusted to '${effectiveCapability}'`);
+            strengths.push(`Adjusted capability '${effectiveCapability}' aligns with tool analysis`);
+        }
+        else {
+            // Neither claimed nor effective capability matches the analysis
+            alignmentScore = Math.max(actualAnalysis.confidence - 40, 10);
+            gaps.push(`Claimed capability '${claimedCapability}' doesn't align with detected capability '${actualCapability}'`);
+            gaps.push(`Tool appears to be: ${actualAnalysis.toolCapabilityDescription}`);
+        }
+        // Add evidence from the capability analysis
+        if (actualAnalysis.evidence && actualAnalysis.evidence.length > 0) {
+            strengths.push(`Supporting evidence: ${actualAnalysis.evidence.slice(0, 2).join('; ')}`);
         }
-        // Determine overall status
+        // Domain validation feedback
+        if (!domainValidation.domain_match) {
+            gaps.push(`Tool type '${domainValidation.detected_tool_type}' not appropriate for this safeguard domain`);
+        }
+        // Determine overall status based on alignment score
         let status;
         if (alignmentScore >= 70) {
             status = 'SUPPORTED';
@@ -6335,18 +6348,18 @@ export class GRCAnalysisServer {
         else {
             status = 'UNSUPPORTED';
         }
-        // Generate recommendations
-        if (gaps.length > 0) {
-            recommendations.push('Address identified gaps to strengthen capability claim');
-        }
+        // Generate capability-focused recommendations
+        recommendations.push(actualAnalysis.recommendedUse);
         if (status === 'QUESTIONABLE') {
-            recommendations.push('Provide additional evidence or clarify scope to support claim');
+            recommendations.push('Consider clarifying tool capabilities or adjusting capability claim');
+        }
+        if (!domainValidation.domain_match) {
+            recommendations.push(`For ${actualCapability.toUpperCase()} capability, focus on how the tool ${actualCapability === 'facilitates' ? 'enables and enhances' : actualCapability === 'governance' ? 'manages policies and processes for' : actualCapability === 'validates' ? 'provides evidence and reporting on' : 'directly implements'} this safeguard`);
         }
-        const feedback = this.generateValidationFeedback(claimedCapability, status, gaps, strengths, alignmentScore);
+        const feedback = this.generateCapabilityValidationFeedback(claimedCapability, effectiveCapability, actualCapability, status, alignmentScore, domainValidation);
         return {
             status,
             confidence: Math.round(alignmentScore),
-            languageConsistency: Math.round(languageConsistency),
             gaps,
             strengths,
             recommendations,
@@ -6404,70 +6417,139 @@ export class GRCAnalysisServer {
         ];
         return this.calculateKeywordScore(text, validationKeywords) * 100;
     }
-    detectToolType(text) {
+    detectToolType(text, safeguardId) {
         const lowerText = text.toLowerCase();
-        // Inventory/Asset Management tools
-        const inventoryKeywords = [
-            'asset management', 'inventory', 'cmdb', 'discovery', 'asset discovery',
-            'hardware inventory', 'software inventory', 'device inventory', 'asset tracking',
-            'configuration management database', 'it asset management', 'endpoint discovery'
-        ];
-        // Identity/Authentication tools  
-        const identityKeywords = [
-            'identity management', 'iam', 'active directory', 'ldap', 'sso', 'single sign-on',
-            'mfa', 'multi-factor', 'authentication', 'identity provider', 'access management',
-            'user management', 'account management', 'directory service'
-        ];
-        // Vulnerability Management tools
-        const vulnerabilityKeywords = [
-            'vulnerability scanner', 'vulnerability management', 'patch management',
-            'security scanner', 'vuln scan', 'penetration test', 'security assessment',
-            'scanning capabilities', 'vulnerability scanning', 'network discovery'
-        ];
-        // Network Security tools
-        const networkSecurityKeywords = [
-            'firewall', 'network access control', 'nac', 'network security', 'intrusion detection',
-            'network monitoring', 'traffic analysis', 'network segmentation'
-        ];
-        // Threat Intelligence/Data Enrichment tools
-        const threatIntelKeywords = [
-            'threat intelligence', 'threat intel', 'threat feed', 'security intelligence',
-            'enrichment', 'data feed', 'contextual data', 'risk intelligence',
-            'cyber threat intelligence', 'ioc feed', 'threat data'
-        ];
-        // GRC/Governance tools
-        const governanceKeywords = [
-            'grc', 'governance', 'compliance management', 'policy management',
-            'risk management', 'audit management', 'compliance platform'
-        ];
-        // Security Analytics/SIEM tools
-        const analyticsKeywords = [
-            'siem', 'security analytics', 'log management', 'security monitoring',
-            'event correlation', 'security orchestration', 'soar'
-        ];
-        // Check for tool type patterns - order by specificity (most specific first)
-        if (threatIntelKeywords.some(keyword => lowerText.includes(keyword))) {
-            return 'threat_intelligence';
-        }
-        else if (vulnerabilityKeywords.some(keyword => lowerText.includes(keyword))) {
-            return 'vulnerability_management';
-        }
-        else if (identityKeywords.some(keyword => lowerText.includes(keyword))) {
-            return 'identity_management';
-        }
-        else if (networkSecurityKeywords.some(keyword => lowerText.includes(keyword))) {
-            return 'network_security';
-        }
-        else if (governanceKeywords.some(keyword => lowerText.includes(keyword))) {
-            return 'governance';
+        // Enhanced keyword definitions with scoring weights and context
+        const toolTypePatterns = {
+            'inventory': {
+                primary: [
+                    'asset management', 'inventory management', 'cmdb', 'configuration management database',
+                    'asset discovery', 'hardware inventory', 'software inventory', 'device inventory',
+                    'asset tracking', 'it asset management', 'endpoint discovery', 'asset lifecycle'
+                ],
+                secondary: [
+                    'inventory', 'discovery', 'device management', 'endpoint management',
+                    'configuration management', 'asset database', 'equipment tracking'
+                ],
+                weight: { primary: 3, secondary: 1 }
+            },
+            'identity_management': {
+                primary: [
+                    'identity management', 'iam', 'active directory', 'identity provider',
+                    'single sign-on', 'sso', 'multi-factor authentication', 'mfa',
+                    'user management', 'account management', 'directory service'
+                ],
+                secondary: [
+                    'ldap', 'authentication', 'access management', 'identity access management',
+                    'user directory', 'account lifecycle', 'privileged access'
+                ],
+                weight: { primary: 3, secondary: 1 }
+            },
+            'vulnerability_management': {
+                primary: [
+                    'vulnerability management', 'vulnerability scanner', 'patch management',
+                    'security scanning', 'vulnerability assessment', 'penetration testing'
+                ],
+                secondary: [
+                    'vuln scan', 'security scanner', 'network scanner', 'scanning capabilities',
+                    'security assessment', 'vulnerability scanning', 'patch deployment'
+                ],
+                weight: { primary: 3, secondary: 1 }
+            },
+            'threat_intelligence': {
+                primary: [
+                    'threat intelligence', 'cyber threat intelligence', 'threat intel',
+                    'threat feed', 'ioc feed', 'security intelligence', 'threat data'
+                ],
+                secondary: [
+                    'enrichment', 'data feed', 'contextual data', 'risk intelligence',
+                    'threat indicators', 'intelligence platform', 'threat correlation'
+                ],
+                weight: { primary: 3, secondary: 1 }
+            },
+            'network_security': {
+                primary: [
+                    'firewall', 'network access control', 'nac', 'intrusion detection',
+                    'network security', 'network segmentation'
+                ],
+                secondary: [
+                    'network monitoring', 'traffic analysis', 'perimeter security',
+                    'network protection', 'network filtering'
+                ],
+                weight: { primary: 3, secondary: 1 }
+            },
+            'governance': {
+                primary: [
+                    'grc', 'governance risk compliance', 'compliance management',
+                    'policy management', 'risk management', 'audit management'
+                ],
+                secondary: [
+                    'governance', 'compliance platform', 'policy enforcement',
+                    'regulatory compliance', 'framework management'
+                ],
+                weight: { primary: 3, secondary: 1 }
+            },
+            'security_analytics': {
+                primary: [
+                    'siem', 'security information event management', 'security analytics',
+                    'soar', 'security orchestration', 'log management'
+                ],
+                secondary: [
+                    'security monitoring', 'event correlation', 'log analysis',
+                    'security intelligence', 'incident response platform'
+                ],
+                weight: { primary: 3, secondary: 1 }
+            }
+        };
+        // Calculate scores for each tool type
+        const toolScores = {};
+        for (const [toolType, patterns] of Object.entries(toolTypePatterns)) {
+            let score = 0;
+            // Check primary keywords
+            for (const keyword of patterns.primary) {
+                if (lowerText.includes(keyword)) {
+                    score += patterns.weight.primary;
+                }
+            }
+            // Check secondary keywords
+            for (const keyword of patterns.secondary) {
+                if (lowerText.includes(keyword)) {
+                    score += patterns.weight.secondary;
+                }
+            }
+            toolScores[toolType] = score;
         }
-        else if (analyticsKeywords.some(keyword => lowerText.includes(keyword))) {
-            return 'security_analytics';
+        // Apply safeguard-specific context weighting if provided
+        if (safeguardId && toolScores) {
+            const contextBonus = 1; // Small bonus for domain alignment
+            // Asset inventory safeguards (1.1, 1.2) favor inventory tools
+            if (['1.1', '1.2'].includes(safeguardId) && toolScores['inventory'] > 0) {
+                toolScores['inventory'] += contextBonus;
+            }
+            // Account inventory safeguards (5.1, 5.2, 5.3) favor identity tools
+            if (['5.1', '5.2', '5.3'].includes(safeguardId) && toolScores['identity_management'] > 0) {
+                toolScores['identity_management'] += contextBonus;
+            }
+            // Authentication safeguards (6.1, 6.2, 6.3) favor identity tools
+            if (['6.1', '6.2', '6.3'].includes(safeguardId) && toolScores['identity_management'] > 0) {
+                toolScores['identity_management'] += contextBonus;
+            }
+            // Vulnerability safeguards (7.1-7.7) favor vulnerability management tools
+            if (['7.1', '7.2', '7.3', '7.4', '7.5', '7.6', '7.7'].includes(safeguardId) && toolScores['vulnerability_management'] > 0) {
+                toolScores['vulnerability_management'] += contextBonus;
+            }
         }
-        else if (inventoryKeywords.some(keyword => lowerText.includes(keyword))) {
-            return 'inventory';
+        // Find the tool type with highest score
+        let maxScore = 0;
+        let detectedType = 'unknown';
+        for (const [toolType, score] of Object.entries(toolScores)) {
+            if (score > maxScore) {
+                maxScore = score;
+                detectedType = toolType;
+            }
         }
-        return 'unknown';
+        // Require minimum score threshold to avoid false positives
+        return maxScore >= 2 ? detectedType : 'unknown';
     }
     validateDomainMatch(safeguardId, claimedCapability, detectedToolType) {
         const domainReq = SAFEGUARD_DOMAIN_REQUIREMENTS[safeguardId];
@@ -6487,7 +6569,7 @@ export class GRCAnalysisServer {
                 required_tool_types: domainReq.required_tool_types,
                 should_adjust_capability: true,
                 adjusted_capability: 'facilitates',
-                reasoning: `${domainReq.domain} safeguard requires ${domainReq.required_tool_types.join('/')} tool types for FULL/PARTIAL coverage. Detected tool type '${detectedToolType}' can only facilitate implementation.`
+                reasoning: `${domainReq.domain} safeguard requires ${domainReq.required_tool_types.join('/')} tool types for FULL/PARTIAL implementation capability. Detected tool type '${detectedToolType}' can only facilitate implementation.`
             };
         }
         return {
@@ -6499,8 +6581,31 @@ export class GRCAnalysisServer {
                 'No domain validation required for this capability type'
         };
     }
+    generateCapabilityValidationFeedback(claimedCapability, effectiveCapability, actualCapability, status, score, domainValidation) {
+        let feedback = `Capability Validation: ${claimedCapability.toUpperCase()} claim is ${status} (${Math.round(score)}% confidence)\n\n`;
+        // Analysis summary
+        feedback += `ANALYSIS:\n`;
+        feedback += `• Claimed: ${claimedCapability.toUpperCase()}\n`;
+        if (effectiveCapability !== claimedCapability) {
+            feedback += `• Domain Adjusted: ${effectiveCapability.toUpperCase()} (${domainValidation.reasoning})\n`;
+        }
+        feedback += `• Detected: ${actualCapability.toUpperCase()}\n`;
+        feedback += `• Tool Type: ${domainValidation.detected_tool_type}\n\n`;
+        // Assessment
+        feedback += `ASSESSMENT: `;
+        if (claimedCapability.toLowerCase() === actualCapability) {
+            feedback += 'Claimed capability aligns perfectly with tool analysis.';
+        }
+        else if (effectiveCapability.toLowerCase() === actualCapability) {
+            feedback += 'After domain validation adjustment, capability aligns with tool analysis.';
+        }
+        else {
+            feedback += `Capability mismatch detected. Tool functions as ${actualCapability.toUpperCase()} rather than claimed ${claimedCapability.toUpperCase()}.`;
+        }
+        return feedback;
+    }
     generateValidationFeedback(claimedCapability, status, gaps, strengths, score) {
-        let feedback = `Validation of ${claimedCapability.toUpperCase()} capability claim: ${status} (${Math.round(score)}% alignment)\n\n`;
+        let feedback = `Validation of ${claimedCapability.toUpperCase()} capability role claim: ${status} (${Math.round(score)}% alignment)\n\n`;
         if (strengths.length > 0) {
             feedback += `STRENGTHS:\n${strengths.map(s => `• ${s}`).join('\n')}\n\n`;
         }
@@ -6510,21 +6615,122 @@ export class GRCAnalysisServer {
         feedback += `ASSESSMENT: `;
         switch (status) {
             case 'SUPPORTED':
-                feedback += 'The vendor\'s supporting evidence strongly aligns with their claimed capability.';
+                feedback += 'The vendor\'s supporting evidence strongly aligns with their claimed capability role.';
                 break;
             case 'QUESTIONABLE':
                 feedback += 'The vendor\'s evidence partially supports their claim but has notable gaps or inconsistencies.';
                 break;
             case 'UNSUPPORTED':
-                feedback += 'The vendor\'s evidence does not adequately support their claimed capability.';
+                feedback += 'The vendor\'s evidence does not adequately support their claimed capability role.';
                 break;
         }
         return feedback;
     }
+    // Enhanced error handling and formatting
+    formatErrorMessage(error, toolName) {
+        if (error instanceof Error) {
+            // Production-friendly error messages
+            switch (error.message) {
+                case /^Safeguard .+ not found/.test(error.message) ? error.message : '':
+                    return `❌ Invalid safeguard ID. Use 'list_available_safeguards' to see available CIS Control safeguards.`;
+                case /^Unknown tool/.test(error.message) ? error.message : '':
+                    return `❌ Tool '${toolName}' is not available. Available tools: analyze_vendor_response, validate_vendor_mapping, validate_coverage_claim, get_safeguard_details, list_available_safeguards.`;
+                default:
+                    return `❌ Error in ${toolName}: ${error.message}`;
+            }
+        }
+        return `❌ Unexpected error in ${toolName}: ${String(error)}`;
+    }
+    getCachedSafeguardDetails(safeguardId, includeExamples) {
+        const cacheKey = `${safeguardId}_${includeExamples}`;
+        const cached = this.cache.safeguardDetails.get(cacheKey);
+        if (cached && (Date.now() - cached.timestamp < 5 * 60 * 1000)) { // 5 minute cache
+            return cached.data;
+        }
+        return null;
+    }
+    setCachedSafeguardDetails(safeguardId, includeExamples, data) {
+        const cacheKey = `${safeguardId}_${includeExamples}`;
+        this.cache.safeguardDetails.set(cacheKey, {
+            data,
+            timestamp: Date.now()
+        });
+        // Periodic cache cleanup to prevent memory leaks
+        if (Date.now() - this.cache.lastCacheCleanup > 10 * 60 * 1000) { // 10 minutes
+            this.cleanupCache();
+        }
+    }
+    cleanupCache() {
+        const now = Date.now();
+        const maxAge = 10 * 60 * 1000; // 10 minutes
+        // Clean up safeguard details cache
+        for (const [key, value] of this.cache.safeguardDetails.entries()) {
+            if (now - value.timestamp > maxAge) {
+                this.cache.safeguardDetails.delete(key);
+            }
+        }
+        this.cache.lastCacheCleanup = now;
+    }
+    recordToolExecution(toolName, executionTime) {
+        this.performanceMetrics.totalRequests++;
+        if (!this.performanceMetrics.toolExecutionTimes.has(toolName)) {
+            this.performanceMetrics.toolExecutionTimes.set(toolName, []);
+        }
+        const times = this.performanceMetrics.toolExecutionTimes.get(toolName);
+        times.push(executionTime);
+        // Keep only last 100 measurements for memory efficiency
+        if (times.length > 100) {
+            times.shift();
+        }
+    }
+    getPerformanceStats() {
+        const uptime = Date.now() - this.performanceMetrics.startTime;
+        const avgTimes = Array.from(this.performanceMetrics.toolExecutionTimes.entries())
+            .map(([tool, times]) => {
+            const avg = times.reduce((a, b) => a + b, 0) / times.length;
+            return `${tool}: ${avg.toFixed(2)}ms`;
+        });
+        return `Performance Stats (Uptime: ${(uptime / 1000).toFixed(1)}s, Requests: ${this.performanceMetrics.totalRequests}, Errors: ${this.performanceMetrics.errorCount})\n${avgTimes.join(', ')}`;
+    }
+    // Input validation and sanitization
+    validateSafeguardId(safeguardId) {
+        if (!safeguardId || typeof safeguardId !== 'string') {
+            throw new Error('Safeguard ID is required and must be a string');
+        }
+        if (!/^[0-9]+\.[0-9]+$/.test(safeguardId)) {
+            throw new Error('Safeguard ID must be in format "X.Y" (e.g., "1.1", "5.1")');
+        }
+        if (!CIS_SAFEGUARDS[safeguardId]) {
+            throw new Error(`Safeguard ${safeguardId} not found`);
+        }
+    }
+    validateTextInput(text, fieldName) {
+        if (!text || typeof text !== 'string') {
+            throw new Error(`${fieldName} is required and must be a string`);
+        }
+        if (text.length > 10000) {
+            throw new Error(`${fieldName} must be less than 10,000 characters`);
+        }
+        if (text.trim().length < 10) {
+            throw new Error(`${fieldName} must contain at least 10 meaningful characters`);
+        }
+    }
+    validateCapability(capability) {
+        const validCapabilities = ['full', 'partial', 'facilitates', 'governance', 'validates'];
+        if (!validCapabilities.includes(capability.toLowerCase())) {
+            throw new Error(`Invalid capability. Must be one of: ${validCapabilities.join(', ')}`);
+        }
+    }
     async run() {
         const transport = new StdioServerTransport();
         await this.server.connect(transport);
         console.error('FrameworkMCP server running on stdio');
+        // Log performance stats every 5 minutes in production
+        if (process.env.NODE_ENV === 'production') {
+            setInterval(() => {
+                console.error(`[FrameworkMCP] ${this.getPerformanceStats()}`);
+            }, 5 * 60 * 1000);
+        }
     }
 }
 const server = new GRCAnalysisServer();