Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure

Source

arXiv

arxiv.org/abs/2607.08288v1

Read the source

Source

Plain-Language Brief

The paper proposes an agent pipeline that converts natural language system descriptions into OSCAL format for continuous automated compliance management in critical infrastructure. The pipeline uses MCP-grounded multi-agent architecture to reduce the risk of fabricated vulnerabilities and hallucinated attack paths, achieving high recall rates in a synthetic scenario. However, incorrectly extracted entities in the initial phase can lead to irrelevant CVEs, but the remaining errors are visible, verifiable, and suitable for manual review.

What the Document Says

  • The paper presents a non-invasive MCP-grounded multi-agent pipeline for continuous automated compliance management in critical infrastructure.
  • The pipeline converts natural language system descriptions into source-verified knowledge graph and audit-ready artifacts in the NIST OSCAL format.
  • It achieves high recall rates, specifically 0.90 CVE recall and perfect D3FEND recall, in a synthetic scenario of a water utility.
  • The pipeline generates a schema-valid OSCAL System Security Plan and an OSCAL Security Assessment Report.
  • The core insight is that grounding via MCP shifts errors into the first phase of asset extraction from the natural language description.
  • Incorrectly extracted entities can lead to irrelevant CVEs in subsequent stages, but the remaining errors are visible, verifiable, and suitable for manual review.

Key Concepts Mentioned

  • critical infrastructure
  • operational technology environments
  • MCP-grounded multi-agent pipeline
  • NIST OSCAL format
  • continuous automated compliance management
  • synthetic scenario
  • CVE recall
  • D3FEND recall
  • OSCAL System Security Plan
  • OSCAL Security Assessment Report

Claims Made by the Document

  • The proposed pipeline achieves high recall rates in a synthetic scenario.
  • Incorrectly extracted entities can lead to irrelevant CVEs in subsequent stages.

Evidence Used

  • 0.90 CVE recall and perfect D3FEND recall achieved in the evidence-based synthetic scenario

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

In critical infrastructure, operational technology environments often cannot be actively scanned, and yet active system feedback is needed for risk assessment and compliance. This paper presents a non-invasive, MCP-grounded multi-agent pipeline that converts natural-language system descriptions into source-verified knowledge graph and audit-ready artifacts in the NIST OSCAL format for continuous automated compliance management. The architecture decouples LLM-based reasoning from deterministic knowledge retrieval against authoritative threat-intelligence sources, reducing the risk of fabricated vulnerabilities and hallucinated attack paths. In an evidence-based synthetic scenario of a water utility, the pipeline achieves 0.90 CVE recall and perfect D3FEND recall. It generates a schema-valid OSCAL System Security Plan and an OSCAL Security Assessment Report. Nevertheless, the core insight is not that grounding via MCP eliminates errors (e.g., hallucinations) entirely from the pipeline, but that it shifts errors into the first phase of asset extraction from the natural language description. Here, a single incorrectly extracted entity can lead to genuine but irrelevant CVEs in subsequent stages of the pipeline, which consumes time and resources. However, it makes the remaining risk visible, verifiable, and suitable for a time-efficient manual review, since the infrastructure (e.g., version numbers, OS, etc.) is typically known.