# coso-mcp [Health: Active]

**Category:** 💰 Finance & Fintech  
**Repository:** https://github.com/simonmak-ascent/coso-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 472  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/coso-mcp

## Description
Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.

## Tools
Capabilities this server exposes over MCP:

- **get_server_info** — Server identity, framework coverage, disclaimer.
- **list_components** — The five COSO components.
- **list_principles** — The 17 principles (optionally filtered by component).
- **get_principle** — A principle by number or slug, with paraphrased points of focus.
- **get_component** — A component by id, with its principles.
- **list_objective_categories** — Operations / reporting / compliance.
- **list_assertions** — The CEAVOP assertions used to frame control objectives.
- **create_engagement** — Create a review engagement.
- **get_engagement** — Get an engagement by id.
- **list_engagements** — List engagements.
- **add_scope_item** — Add a significant account/process to scope.
- **list_scope_items** — List scope items.
- **register_risk** — Register a risk to objectives (likelihood, assertions, principles, fraud).
- **list_risks** — List registered risks.
- **register_control** — Register a control (type, frequency, linked risks, assertions).
- **list_controls** — List registered controls.
- **get_audit_log** — Append-only audit events for an engagement.
- **compute_sample_size** — Recommended sample size from frequency × risk, with rationale.
- **create_population** — Register a population (item list or declared size, bounded).
- **list_populations** — List populations.
- **select_sample** — Seeded, reproducible sample selection (random/systematic/targeted/haphazard).
- **record_test_result** — Record attribute-level outcomes (pass/fail/na) and a conclusion.
- **list_test_results** — List test results.
- **note_exception** — Record an exception with root cause and impact.
- **list_exceptions** — List exceptions.
- **assemble_workpaper** — Assemble a Markdown control-testing workpaper.
- **list_workpapers** — List workpapers.
- **get_workpaper** — Get a workpaper with its Markdown.
- **add_review_note** — Add a reviewer note.
- **resolve_review_note** — Resolve a reviewer note.
- **sign_off** — Preparer/reviewer sign-off (warns on same-person independence).
- **get_activity_log** — Append-only activity log for an engagement.
- **classify_deficiency** — Classify a deficiency (deficiency / significant / material weakness).
- **list_deficiencies** — List deficiencies.
- **aggregate_deficiencies** — Group and flag deficiencies that may aggregate.
- **assess_principle** — Coverage indicators for one COSO principle.
- **assess_component** — Coverage indicators for one COSO component.
- **framework_integration_check** — Check all five components have coverage.
- **generate_report** — Generate the Markdown review report.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "coso-mcp": {
    "command": "npx",
    "args": ["-y","@simonmak-ascent/coso-mcp"]
  }
}
```

## Documentation

## What coso-mcp does

The coso-mcp MCP server supports internal-control reviews based on the COSO Internal Control—Integrated Framework (ICIF-2013). Its reference tools expose the framework’s five components, 17 principles, points of focus, objective categories, and CEAVOP assertions. Its workflow tools support an engagement from initial scope through testing documentation and review activities.

A review can contain significant accounts or processes, linked risks, controls, control frequencies, assertions, populations, and test results. The server also provides append-only audit or activity logs, reviewer notes, deficiency classification, framework coverage checks, and Markdown report generation. The available workflow is relevant to teams in the 💰 Finance & Fintech category that need COSO-oriented review records and repeatable testing steps.

The coso-mcp MCP server is a methodology and workflow aid, not a replacement for professional audit judgment. Workpapers and assessments should be reviewed by qualified professionals before inclusion in audit documentation.

## How it works

The local deployment starts as an MCP process over stdio. A compatible client can invoke read tools for framework content and engagement data, then use write tools to create or update review records. The hosted deployment uses streamable HTTP at `https://internal-control.ascent-partners.com/mcp`.

Sampling is based on frequency and risk inputs. Populations may contain an item list or a declared, bounded size. Sample selection supports random, systematic, targeted, and haphazard methods, with seeded selection for reproducible results. Test results record attribute-level pass, fail, or not-applicable outcomes and a conclusion. Exceptions can include root cause and impact information.

Workpapers are assembled as Markdown and can be listed or retrieved. Review notes can be added and resolved. Additional tools assess principle and component coverage, check integration across all five COSO components, classify and aggregate deficiencies, and generate a Markdown review report.

## Setup and configuration

Run the local package with:

```bash
npx -y @simonmak-ascent/coso-mcp
```

For Claude Desktop or another generic MCP client, configure a server entry that uses `npx` as the command, with `-y` and `@simonmak-ascent/coso-mcp` as arguments. No environment variables are documented as required.

The hosted endpoint is publicly accessible and does not require an account according to the supplied material. Write operations there run in an isolated, rate-limited sandbox for the session and are not persisted. The local mode is the appropriate option when review state needs to remain in the local server process rather than using the hosted endpoint’s ephemeral session behavior.

## Tools and capabilities

Reference and planning tools include `get_server_info`, `list_components`, `list_principles`, `get_principle`, `get_component`, `list_objective_categories`, and `list_assertions`.

Engagement and testing tools include:

- Create engagements, scope items, risks, controls, and populations.
- Compute recommended sample sizes and select reproducible samples.
- Record test results and exceptions.
- Assemble, list, and retrieve Markdown workpapers.
- Add and resolve reviewer notes.
- Read engagement audit or activity logs.
- Assess principles, components, and framework integration.
- Classify or aggregate deficiencies and generate a review report.

The server also exposes the `coso://framework/icif-2013` and `coso://engagement/{id}` resources, along with prompts for scoping, risk assessment, control-matrix construction, test-workpaper drafting, and deficiency evaluation.

## Limitations and notes

The hosted mode does not preserve write operations after the session. The supplied material does not describe persistence behavior for local engagements beyond its stdio execution model. Sampling recommendations and generated documents support a review process but do not establish audit conclusions by themselves. The project’s disclaimer states that it is not audit or legal advice.

The coso-mcp MCP server is licensed under MIT. Security reporting and contribution procedures are referenced in the repository, but their detailed requirements are not included in the supplied material.

_Full upstream README: https://allmcps.com/mcp/coso-mcp/readme_