framework-mcp 2.4.6 → 2.6.0

package/README.md

@@ -63,7 +63,7 @@ npm run start:http
 
 | Tool | Description |
 |------|-------------|
-| `get_safeguard_details` | Get detailed safeguard breakdown with capability-specific prompts |
+| `get_safeguard_details` | Get detailed safeguard breakdown (governance elements, core requirements, sub-taxonomical elements, implementation suggestions) |
 | `list_available_safeguards` | List all 153 CIS safeguards |
 
 ### HTTP Endpoints
@@ -91,17 +91,42 @@ curl http://localhost:8080/api/safeguards/1.1
 curl http://localhost:8080/api/safeguards/5.1?include_examples=true
 ```
 
-## The 5 Capability Roles
+## Assessing a Tool Against a Safeguard
 
-Each safeguard includes prompts for five assessment types:
+> **This framework assesses one tool in isolation against one safeguard.**
+> Satisfying a safeguard is a *portfolio* property — it typically takes several
+> tools across several asset types. No verdict below means a safeguard is met,
+> covered, or compliant.
 
-| Role | Field | Use Case |
-|------|-------|----------|
-| **Full** | `systemPromptFull` | Vendors features have mapped to all the sub taxonomical elements of the safeguard but FULL does not mean it completely does all asset classes, software types, etc, only that it does it for A particular Asset Class |
-| **Partial** | `systemPromptPartial` | Vendors features have mapped to some of the sub taxonomical elements of the safeguard but are missing one or another, As with full PARTIAL does not mean they cover all asset classes, software types, only that it does it for a particular Asset Class |
-| **Facilitates** | `systemPromptFacilitates` | Tool empowers others to implement, better, faster, more completely, usually with data |
-| **Governance** | `systemPromptGovernance` | Policy/process/oversight capabilities |
-| **Validates** | `systemPromptValidates` | Audit/evidence/reporting capabilities |
+### Element completeness — what this framework *can* assess
+
+A tool is assessed on how many of the safeguard's **taxonomical elements** it addresses:
+
+| `elementsAddressed` | Meaning |
+|------|-------------|
+| **`all`** | The tool addresses every taxonomical element of the safeguard |
+| **`some`** | The tool addresses some, but not all, taxonomical elements |
+| **`none`** | The tool addresses no taxonomical elements of this safeguard |
+
+The companion `notAddressed` list — which elements the tool *doesn't* reach — is
+often more useful than the verdict itself, because it names what you still need.
+
+### Estate scope — what this framework *cannot* assess
+
+`elementsAddressed: "all"` is **not** estate coverage. A tool that addresses every
+element of safeguard 9.2 still only protects the devices it is actually deployed on.
+Whether *your* estate is protected depends on your asset inventory, deployment
+footprint, and licensing — none of which are visible in a vendor response. Every
+assessment therefore carries a `scopeLimits` block stating what remains unassessed.
+
+Deliberately absent vocabulary: *meets, satisfies, covers, achieves, compliant.*
+Each of those terminates the sentence and implies the practitioner is finished.
+
+### GRC / policy services
+
+Whether a tool is a GRC or policy service is a **single yes/no question asked once
+per tool** (`isGrcOrPolicyService`), not a per-safeguard classification — it is a
+property of the product, not of its relationship to any one safeguard.
 
 ## Cloud Deployment
 

package/dist/core/safeguard-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safeguard-manager.d.ts","sourceRoot":"","sources":["../../src/core/safeguard-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAc,MAAM,oBAAoB,CAAC;AAElE,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAQ;IAC9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAChE,OAAO,CAAC,kBAAkB,CAAyB;IACnD,OAAO,CAAC,WAAW,CAAa;;IAQzB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,GAAE,OAAe,GAAG,gBAAgB,GAAG,IAAI;IA4BnG,uBAAuB,IAAI,MAAM,EAAE;IAgBnC,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAIpD,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAerD,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,2BAA2B;IAmCnC;;OAEG;IACI,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IAO7D;;OAEG;IACI,UAAU,IAAI,IAAI;IAKzB,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,yBAAyB;IA2BjC,OAAO,CAAC,oBAAoB;CAwzgB7B"}
+{"version":3,"file":"safeguard-manager.d.ts","sourceRoot":"","sources":["../../src/core/safeguard-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAc,MAAM,oBAAoB,CAAC;AAElE,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAQ;IAC9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAChE,OAAO,CAAC,kBAAkB,CAAyB;IACnD,OAAO,CAAC,WAAW,CAAa;;IAQzB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,GAAE,OAAe,GAAG,gBAAgB,GAAG,IAAI;IA4BnG,uBAAuB,IAAI,MAAM,EAAE;IAgBnC,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAIpD,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAerD,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,2BAA2B;IAmCnC;;OAEG;IACI,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IAO7D;;OAEG;IACI,UAAU,IAAI,IAAI;IAKzB,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,yBAAyB;IA2BjC,OAAO,CAAC,oBAAoB;CAu1I7B"}