· Upon request
CPCSC compliance toolchain
An MCP toolchain that runs CPCSC Level 1 self-assessments against Azure subscriptions.
A set of Model Context Protocol tools for running Canadian Program for Cyber Security Certification (CPCSC) Level 1 self-assessments against Azure subscriptions, producing gap reports and a formatted assessment document.
Shape of it
The toolchain exposes assessment operations as MCP tools — list controls, assess a control, list failing resources, summarize compliance, generate a gap report, generate a Level 1 self-assessment. An assistant with these tools available can work through an assessment conversationally and produce the deliverable at the end.
It runs as a stateless HTTP MCP server, containerized, deployed to Azure Container Apps with scale-to-zero — which suits a workload that is idle most of the time and bursty when someone is actually doing an assessment. Stateless by design covers what that took, and what changed when the MCP spec went stateless too.
What was harder than expected
The report, not the assessment. Producing a document with proper structure — scope, method, results grouped by control family, evidence per finding, exceptions with justification, a sign-off block — took considerably longer than the logic that evaluates the controls.
Licensing
The toolchain is moving to the Business Source License 1.1: source-available, free for self-assessment use, commercial and hosted rights reserved, with automatic conversion to an open-source licence at the change date. Details are in the announcement on LinkedIn.