ckl-mcp

Maintained by Athena Cyber Defense LLC, building automated ATO-as-Code and multi-agent compliance systems. Contact us for enterprise NIST SP 800-53 mapping and OSCAL acceleration.

An MCP (Model Context Protocol) server that lets an AI agent work with DISA STIG checklists (.ckl / .cklb): load and query them, record findings, apply SCAP scan results, carry a prior assessment into a new STIG release, and produce Excel reports.

Prefer a desktop app? This is the agent-facing companion to Ckl-viewer, the Windows UI for viewing and editing STIG checklists. Both share the same parsing and reporting engine, so files and Excel reports move freely between them.

It speaks MCP over stdio for local clients, and over an opt-in, token-protected Streamable HTTP transport for hosted model APIs and remote clients. That covers Claude, ChatGPT/Codex, Gemini, GitHub Copilot, Cursor, and the client SDKs from all three model vendors. See Connect your model.

What it can do

• Load .ckl, .cklb, DISA XCCDF benchmarks (.xml/.zip), and previously exported .xlsx reports.
• Query with the same filters as the Ckl-viewer UI (status, severity, STIG, free text), paged so a 400-rule STIG doesn’t flood the model’s context.
• Edit status, finding details, comments, severity overrides and asset fields, one finding at a time or in bulk. Edits stay in memory until you save.
• Apply SCAP XCCDF results, matching by rule version and rule id.
• Merge a prior assessment into a new STIG release, flagging or resetting rules whose text changed.
• Save in place or convert between .ckl and .cklb.
• Report to a Vulnerator-style Excel workbook (Executive Summary, POA&M, Vulnerability Details). Status and severity cells recolor themselves if you edit them in Excel, and the workbook can be loaded back in.
• Diff two checklists (what opened, what closed).

Quick start

1. Get the server

Download the latest build from Releases and unpack it. Builds are published for Windows x64 (zip), Linux x64 and macOS Apple silicon (tar.gz). The self-contained builds need nothing else; the Windows framework-dependent one needs the .NET 8 runtime. On Linux and macOS you may need chmod +x CklMcp.Server, and on macOS, xattr -d com.apple.quarantine CklMcp.Server because the build is not code-signed. Any other platform (for example Intel Macs or Linux ARM) can build from source.