Coso MCP

What coso-mcp does

The coso-mcp MCP server supports internal-control reviews based on the COSO Internal Control—Integrated Framework (ICIF-2013). Its reference tools expose the framework’s five components, 17 principles, points of focus, objective categories, and CEAVOP assertions. Its workflow tools support an engagement from initial scope through testing documentation and review activities.

A review can contain significant accounts or processes, linked risks, controls, control frequencies, assertions, populations, and test results. The server also provides append-only audit or activity logs, reviewer notes, deficiency classification, framework coverage checks, and Markdown report generation. The available workflow is relevant to teams in the 💰 Finance & Fintech category that need COSO-oriented review records and repeatable testing steps.

The coso-mcp MCP server is a methodology and workflow aid, not a replacement for professional audit judgment. Workpapers and assessments should be reviewed by qualified professionals before inclusion in audit documentation.

How it works

The local deployment starts as an MCP process over stdio. A compatible client can invoke read tools for framework content and engagement data, then use write tools to create or update review records. The hosted deployment uses streamable HTTP at https://internal-control.ascent-partners.com/mcp.

Sampling is based on frequency and risk inputs. Populations may contain an item list or a declared, bounded size. Sample selection supports random, systematic, targeted, and haphazard methods, with seeded selection for reproducible results. Test results record attribute-level pass, fail, or not-applicable outcomes and a conclusion. Exceptions can include root cause and impact information.

Workpapers are assembled as Markdown and can be listed or retrieved. Review notes can be added and resolved. Additional tools assess principle and component coverage, check integration across all five COSO components, classify and aggregate deficiencies, and generate a Markdown review report.

Setup and configuration

Run the local package with:

npx -y @simonmak-ascent/coso-mcp

For Claude Desktop or another generic MCP client, configure a server entry that uses npx as the command, with -y and @simonmak-ascent/coso-mcp as arguments. No environment variables are documented as required.

The hosted endpoint is publicly accessible and does not require an account according to the supplied material. Write operations there run in an isolated, rate-limited sandbox for the session and are not persisted. The local mode is the appropriate option when review state needs to remain in the local server process rather than using the hosted endpoint’s ephemeral session behavior.

Tools and capabilities

Reference and planning tools include get_server_info, list_components, list_principles, get_principle, get_component, list_objective_categories, and list_assertions.

Engagement and testing tools include:

• Create engagements, scope items, risks, controls, and populations.
• Compute recommended sample sizes and select reproducible samples.
• Record test results and exceptions.
• Assemble, list, and retrieve Markdown workpapers.
• Add and resolve reviewer notes.
• Read engagement audit or activity logs.
• Assess principles, components, and framework integration.
• Classify or aggregate deficiencies and generate a review report.

The server also exposes the coso://framework/icif-2013 and coso://engagement/{id} resources, along with prompts for scoping, risk assessment, control-matrix construction, test-workpaper drafting, and deficiency evaluation.

Limitations and notes

The hosted mode does not preserve write operations after the session. The supplied material does not describe persistence behavior for local engagements beyond its stdio execution model. Sampling recommendations and generated documents support a review process but do not establish audit conclusions by themselves. The project’s disclaimer states that it is not audit or legal advice.

The coso-mcp MCP server is licensed under MIT. Security reporting and contribution procedures are referenced in the repository, but their detailed requirements are not included in the supplied material.