Agentic Agile Authoring

An ecosystem of portable authoring skills for OSCAL-based compliance work — from framework onboarding (compliance PDF → catalog, catalog ↔ catalog mapping) through catalog customization, component definition, and assessment to POA&M generation — installable into multiple agent harnesses (Claude Code, OpenCode, IBM Bob, custom harnesses, …).

The OSCAL Compass project is hosted by the Cloud Native Computing Foundation (CNCF).

Three first-class objects

Skill — a unit of authoring know-how (SKILL.md + an apm.yml package manifest + optional scripts/references/assets), portable across harnesses. A skill that needs an MCP server declares it in apm.yml (dependencies.mcp).
Demo — an end-to-end walkthrough exercising N skills, captured as a single demos/<name>/README.md. See Architecture and the Design Spec.
MCP dependency — declared in apm.yml, resolved and wired into the target harness's native MCP config on install; not hardcoded anywhere.

Install

Skills are installed by compliance-authoring-skills, a thin CLI (in tools/) that wraps OpenAPM (apm-cli). Prerequisite: uv (provides uvx) — no Node required.

uvx \
  --from "git+https://github.com/oscal-compass/agentic-agile-authoring.git@main#subdirectory=tools" \
  compliance-authoring-skills install --demo catalog-to-assessment --target claude
uvx \
  --from "git+https://github.com/oscal-compass/agentic-agile-authoring.git@main#subdirectory=tools" \
  compliance-authoring-skills install --demo catalog-to-assessment --target opencode
uvx \
  --from "git+https://github.com/oscal-compass/agentic-agile-authoring.git@main#subdirectory=tools" \
  compliance-authoring-skills install --demo catalog-to-assessment --target bob

This copies the selected skills into the target's native skill dir (.claude/skills/ for Claude, .agents/skills/ for OpenCode, .bob/skills/ for Bob) and wires the trestle MCP server into the target's native MCP config (.mcp.json / opencode.json / .bob/mcp.json) — non-destructively. See the Development guide and the Design Spec for the full model, subset selection, uninstall/prune, and the custom-harness path.

Demo

The full authoring lifecycle — tailoring a NIST SP 800-53 catalog, mapping controls to a Kubernetes component, and generating an assessment result — is captured as a runnable walkthrough, catalog-to-assessment. Its demos/catalog-to-assessment/README.md carries a demo video, the install steps, the prompts to give the agent in order, and uninstall (e.g. the generated catalog.json passes trestle validate).

Skills

See the Skills reference.

Skill	Description
`catalog-authoring`	Import NIST OSCAL assets, edit parameters, generate CSV templates, deploy Markdown catalogs
`component-definition`	Map abstract controls to component-specific rules and validation checks; generate `component-definition.json`
`assessment`	Evaluate control compliance from component definitions and validation scan results
`poam-authoring`	Author an OSCAL POA&M from an assessment's failed findings — remediation plan, milestones, POC, due date
`compliance-catalog`	Convert a compliance-document PDF (law, regulation, standard) into a validated OSCAL Catalog
`compliance-mapping`	Map controls between two OSCAL Catalogs into an OSCAL Mapping Collection + browsable HTML report
`git-workflow`	Two-branch Git strategy for change tracking and PR review of compliance documents (opt-in)

License

Unless otherwise noted, files in this repository are licensed under the Apache License 2.0. Some skill directories include their own LICENSE.txt, which governs files in that directory.

We are a Cloud Native Computing Foundation sandbox project.

The Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see Trademark Usage.