COSO Internal Control Review — MCP server
An open Model Context Protocol server for internal-control reviews under the COSO Internal Control—Integrated Framework (ICIF-2013).
What it does
Runs the full review lifecycle: scope → risk assessment → control register → population → sampling → testing → workpapers → review sign-off → deficiency evaluation → report — grounded in the framework's 5 components, 17 principles and points of focus.
Endpoint
Streamable HTTP, open access. Writes run in an ephemeral, isolated, rate-limited session and are never persisted.
https://internal-control.ascent-partners.com/mcpDiscovery: /.well-known/mcp
Use it locally
{
"mcpServers": {
"coso": { "command": "npx", "args": ["-y", "@simonmak-ascent/coso-mcp"] }
}
}Why it exists
Existing MCP servers either expose a vendor's GRC records (read-mostly, proprietary) or cover
ISO 27001 / security controls. coso-mcp is the first open, COSO/ICFR-native,
write-capable MCP that runs a traceable review — the lifecycle layer, not the data layer.
| Capability | coso-mcp | Vendor GRC MCPs |
|---|---|---|
| COSO 5 components / 17 principles native | Yes | No |
| Full lifecycle to signed workpaper | Yes | Read-only |
| Deterministic sampling & deficiency math | Yes | Partial |
| Open source + open access | Yes | Paid platform |
Tools
Reference (list_components, list_principles, get_principle,
list_assertions), engagement (create_engagement, add_scope_item,
register_risk, register_control), testing (compute_sample_size,
create_population, select_sample, record_test_result,
note_exception), workpapers (assemble_workpaper, add_review_note,
sign_off), and assessment (classify_deficiency,
aggregate_deficiencies, assess_component, generate_report).
This server assists with internal-control review methodology. It does not provide audit or legal advice. All workpapers and assessments must be reviewed by qualified professionals before use in audit documentation.