Security Assessment Advisor
Tools
Every tool the Security Assessment Advisor servers offer, by standard, with what each one does.
The Advisor is three MCP servers that share one shape. Each standard has tools to read it, tools to run an assessment against it, and tools to export the result. The hosted service serves all three from one address; a local deployment runs each as its own server.
ASD ISM
| Tool | What it does |
|---|---|
ism_current_release | The ISM release the server is answering from. |
ism_list_baselines | The baselines (NON_CLASSIFIED to TOP_SECRET, and Essential Eight maturity levels 1 to 3) with their control counts. |
ism_search_controls | Search controls by a word in the id, title or statement, optionally within a baseline. |
ism_get_control | One control by id, quoted in full. Unknown ids return suggestions, never a guess. |
ism_check_for_updates, ism_list_cached_releases, ism_diff_releases | Whether a newer release exists, which releases are cached, and what changed between two releases. |
ism_list_ot_frameworks, ism_get_ot_overlay, ism_search_ot_controls | The operational technology overlay: IEC 62443, NIST SP 800-82, Purdue levels and the ASD principles of operational technology cyber security, mapped to ISM controls. |
ism_assessment_wizard | Scope an assessment: the qualifying questions, as a form or as text. |
ism_assessment_next | The walk-through: the next controls to put to you, with their text, and the updated assessment. Also how a saved assessment resumes. |
ism_save_assessment | The assessment so far, as a file to keep. |
ism_gap_analysis | Coverage, counts by status and the top gaps. |
ism_export_ssp_annex | The SSP annex workbook. |
ism_export_poam | An OSCAL 1.1 plan of action and milestones. |
ism_generate_document | A report as Markdown, Word, PowerPoint or CSV. |
ASD Essentials for Enterprise IT
| Tool | What it does |
|---|---|
essentials_current_release | The Essentials release the server is answering from. |
essentials_list_domains, essentials_list_principles, essentials_list_actions | The domains, the principles, and the actions with their indicators of good practice. |
essentials_search_actions | Search actions by a word, optionally within a domain or principle. |
essentials_get_action | One action by id, with its indicators. |
essentials_crosswalk | ASD's mapping from an action to the ISM, the Essential Eight, NIST CSF 2.0, SP 800-171r3 and AESCSF. |
essentials_check_for_updates, essentials_list_cached_releases, essentials_diff_releases | Release checks and comparisons. |
essentials_assessment_wizard, essentials_assessment_next, essentials_save_assessment | Scope, walk through by domain with the indicators as the questions, and save. |
essentials_gap_analysis | The effectiveness report: action ratings by domain, principle ratings by the weakest link, and the summary by priority phase. |
essentials_export_workbook | The results workbook. |
essentials_generate_document | A report as Markdown, Word, PowerPoint or CSV. |
essentials_ism_evidence_map | What an existing ISM or Essential Eight assessment evidences for each action. Evidence for an assessor, never a rating. |
OWASP ASVS
| Tool | What it does |
|---|---|
asvs_current_release | The ASVS release the server is answering from. |
asvs_list_levels, asvs_list_chapters, asvs_list_requirements | The levels, the chapters, and the requirements in a chapter or at a level. |
asvs_search_requirements | Search requirements by a word, optionally within a level or chapter. |
asvs_get_requirement | One requirement by id, quoted in full. |
asvs_check_for_updates, asvs_list_cached_releases, asvs_diff_releases | Release checks and comparisons. |
asvs_assessment_wizard, asvs_assessment_next, asvs_save_assessment | Scope, walk through, and save. |
asvs_gap_analysis | Coverage of the target level, by chapter. |
asvs_export_checklist | The checklist workbook. |
asvs_generate_document | A report as Markdown, Word, PowerPoint or CSV. |
Settings the tools share
| Argument | On | What it does |
|---|---|---|
assessment or assessmentPath | Assessment and export tools | The assessment document, inline or as a saved file. There is no session on the server: the document is the state. |
delivery | Exports and save | How a document comes back: inline, embedded in the answer, a download link, or a file on the server's disk. The default picks the one you can actually reach. |
outputPath | Exports and save | Where to write the file when the server runs on your own machine. Ignored on a remote server, where a written file would be out of reach. |
presentation | Wizard, walk-through, gap analysis, save and the workbook exports | auto draws the interactive view where the client can; text returns the complete result as text even there, for an agent working with nobody at the screen; view is the same as auto, since a view is never claimed where the client cannot draw one. |