
Connects to TheArtOfService's compliance knowledge graph via streamable HTTP, exposing 692+ frameworks like SOC 2, HIPAA, and ISO 27001 through ten search and mapping tools. You can query frameworks by jurisdiction, pull controls filtered by domain, trace cross-references between equivalent controls across standards, and generate coverage reports showing how one framework maps to another. Works anonymously for 10 calls per day or with a free API key for 100 monthly calls. Reach for this when you're building compliance workflows, need to map security controls between frameworks, or want to answer questions like "which NIST controls satisfy this SOC 2 requirement" without maintaining your own mapping tables.
This repository contains the source of an MCP (Model Context Protocol) server
implementation, under npm/. It speaks MCP over stdio to any MCP client and is
published as @theartofservice/compliance-mcp.
Alongside it, python/ holds a LangChain toolkit for the same API. That one is
not an MCP server, it is an SDK, and it is here because it targets the same graph.
The server exposes a compliance knowledge graph of 686 frameworks, 21,696+ controls and 300K+ cross-framework mappings, where a mapping records what one standard already evidences of another, along with the reasoning and the rejections.
| what it is | source | published as | |
|---|---|---|---|
| Node | MCP server, stdio | npm/src/index.js | @theartofservice/compliance-mcp |
| Python | LangChain toolkit, not MCP | python/src/theartofservice_compliance/ | theartofservice-compliance |
The Node implementation is built on the official @modelcontextprotocol/sdk, registering
its tools through Server and serving them over StdioServerTransport.
| tool | what it answers |
|---|---|
search_frameworks | find a standard by name or subject |
get_framework | one framework in full, with its domains |
get_framework_controls | the control set of a framework |
search_controls | find controls by text across the graph |
cross_framework_map | what standard A already evidences of standard B |
coverage_report | how much of a target standard a source covers |
npx -y @theartofservice/compliance-mcp
Tools list without a key, so any client can inspect the server. Calling one needs
THEARTOFSERVICE_API_KEY. If you would rather not sign up for anything, the hosted
endpoint below serves the same graph anonymously.
Claude Desktop, Claude Code, Cursor, Windsurf and any other MCP client can launch either one directly. Add to your client config:
{
"mcpServers": {
"compliance": {
"command": "npx",
"args": ["-y", "@theartofservice/compliance-mcp"]
}
}
}
If you would rather not run anything, the same server is hosted:
https://api.theartofservice.com/mcp
Streamable HTTP, anonymous access. It is listed in the official MCP registry as
com.theartofservice/compliance-intelligence.
The figures above are read from the live graph. They move, so treat them as a floor rather than a fixed number, and read the current values from:
https://api.theartofservice.com/api/agent/stats
MIT. See LICENSE.