How do I install Coso?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Coso need an API key?

No required environment variable is listed on this record.

When was Coso last checked?

Last checked 2026-11-08. Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.

Coso MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://internal-control.ascent-partners.com/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http com.ascent-partners-coso-mcp https://internal-control.ascent-partners.com/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "com.ascent-partners-coso-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://internal-control.ascent-partners.com/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 0.1.2
Last checked

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

coso-mcp

An open Model Context Protocol server for internal-control reviews under the COSO Internal Control—Integrated Framework (ICIF-2013). It covers the full review lifecycle — scope → risk assessment → control register → population → sampling → testing → workpapers → review sign-off → deficiency evaluation → report — grounded in the framework's 5 components, 17 principles and points of focus.

Local: runs over stdio (npx @simonmak-ascent/coso-mcp).
Hosted: public endpoint at https://internal-control.ascent-partners.com/mcp (reference + read tools, plus an ephemeral per-session sandbox for the full write lifecycle — nothing persists).

Not audit or legal advice. This server assists with internal-control review methodology. All workpapers and assessments must be reviewed by qualified professionals before use in audit documentation.

Why this exists (competitive advantage)

Existing MCP servers either expose a vendor's GRC records (read-mostly, proprietary, product-shaped) or cover ISO 27001 / security controls. None runs a traceable COSO review. coso-mcp is the first COSO/ICFR-native, write-capable, open MCP for the whole lifecycle.

Dimension	coso-mcp	Vendor GRC MCPs (Workiva, Vanta, Drata, Optro, OpenPages, LogicGate…)	Community MCPs (iso27001-mcp, unidoc/isms, mcp-server-scf…)	AI skills (sox-testing / audit-support)
COSO ICIF-2013 native (5 components / 17 principles / points of focus)	✅ core engine	❌ product objects	❌ ISO/SCF-shaped	⚠️ text only
Full lifecycle to signed workpaper	✅	❌ retrieval; Workiva GRC tools are read-only	❌ planning/findings at best	⚠️ templates, not executable
Write/stateful workpapers + preparer/reviewer sign-off + audit trail	✅	❌ mostly read	❌	❌
Framework effectiveness (principle/component present & functioning)	✅	❌	❌	❌
Deterministic, reproducible computation (sample-size tables, seeded selection)	✅	partial	❌	❌ (freeform)
Open source + open access (MIT, public endpoint, no account)	✅	❌ paid platform	⚠️ some OSS	⚠️ not a server

Moat: it is the lifecycle layer, not the data layer — it can sit on top of Workiva/Vanta/Drata rather than compete for their data; its sampling and deficiency math are computed, not improvised; and openness gives zero-friction distribution no gated vendor can match.

Tools

Tool	Kind	Purpose
`get_server_info`	read	Server identity, framework coverage, disclaimer.
`list_components`	read	The five COSO components.
`list_principles`	read	The 17 principles (optionally filtered by component).
`get_principle`	read	A principle by number or slug, with paraphrased points of focus.
`get_component`	read	A component by id, with its principles.
`list_objective_categories`	read	Operations / reporting / compliance.
`list_assertions`	read	The CEAVOP assertions used to frame control objectives.
`create_engagement`	write	Create a review engagement.
`get_engagement`	read	Get an engagement by id.
`list_engagements`	read	List engagements.
`add_scope_item`	write	Add a significant account/process to scope.
`list_scope_items`	read	List scope items.
`register_risk`	write	Register a risk to objectives (likelihood, assertions, principles, fraud).
`list_risks`	read	List registered risks.
`register_control`	write	Register a control (type, frequency, linked risks, assertions).
`list_controls`	read	List registered controls.
`get_audit_log`	read	Append-only audit events for an engagement.
`compute_sample_size`	read	Recommended sample size from frequency × risk, with rationale.

Resources: coso://framework/icif-2013 (framework reference), coso://engagement/{id} (engagement bundle: scope, risks, controls). Prompts: scope-review, assess-risk, build-control-matrix, draft-test-workpaper, evaluate-deficiencies.

Usage

Local (stdio)

npx -y @simonmak-ascent/coso-mcp

Claude Desktop / generic MCP client config:

{
  "mcpServers": {
    "coso": {
      "command": "npx",
      "args": ["-y", "@simonmak-ascent/coso-mcp"]
    }
  }
}

Hosted (streamable HTTP)

https://internal-control.ascent-partners.com/mcp

The hosted endpoint is open. Write operations run in an ephemeral, isolated, rate-limited per-session sandbox and are not persisted.

Development

Compute runs on a box, never locally: cs run "<cmd>".

pnpm install
pnpm typecheck
pnpm test
pnpm test:coverage
pnpm build        # tsc

Security

See SECURITY.md. Report vulnerabilities privately — do not open a public issue.

Contributing

See CONTRIBUTING.md and the Code of Conduct.

Coso

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Coso?

Does Coso need an API key?

What transport does Coso use?

When was Coso last checked?

Documentation

coso-mcp

Why this exists (competitive advantage)

Tools

Usage

Local (stdio)

Hosted (streamable HTTP)

Development

Security

Contributing

License