· in-progress
CPCSC compliance toolchain
An MCP toolchain that runs CPCSC Level 1 self-assessments against Azure subscriptions and produces the Word deliverable an assessor actually reads.
A set of Model Context Protocol tools for running Canadian Program for Cyber Security Certification (CPCSC) Level 1 self-assessments against Azure subscriptions, producing gap reports and a formatted assessment document.
Shape of it
The toolchain exposes assessment operations as MCP tools — list controls, assess a control, list failing resources, summarise compliance, generate a gap report, generate a Level 1 self-assessment. An assistant with these tools available can work through an assessment conversationally and produce the deliverable at the end.
It runs as a stateless HTTP MCP server, containerised, deployed to Azure Container Apps with scale-to-zero — which suits a workload that is idle most of the time and bursty when someone is actually doing an assessment.
What was harder than expected
The report, not the assessment. Producing a document with proper structure — scope, method, results grouped by control family, evidence per finding, exceptions with justification, a sign-off block — took considerably longer than the logic that evaluates the controls. More on that here.
Licensing
Moving to Business Source License 1.1: source-available, free for self-assessment use, commercial and hosted rights reserved, with automatic conversion to an open-source licence at the change date. Detail on the Exploits Bay site.