CISO Assistant - A2A | AG-UI | MCP

CISO Assistant - A2A | AG-UI | MCP

Version: 0.1.0

Overview

CISO Assistant is a production-grade Python API client, Model Context Protocol(MCP) server, and A2A agent for CISO Assistant,intuitem's open-source GRC platform for Risk Management, AppSec, Compliance &Audit, TPRM, BIA, Privacy, and Reporting.

It provides 100% coverage of the CISO Assistant REST API — every one of the~1,565 operations in the drf-spectacular schema is exposed as both a typedclient method and an action-routed MCP tool. The client, MCP tools, and amachine-readable coverage manifest are all generated from the vendored OpenAPIspec (ciso_assistant_api/specs/ciso_assistant.json) byscripts/generate_from_openapi.py, and a coverage test asserts the three setsstay in lock-step.

Key Features

• 100% Action-Routed MCP Tools — one consolidated tool per domain (e.g.ciso_assistant_compliance, ciso_assistant_risk_management,ciso_assistant_incidents) takes an action plus a params_json payload androutes to the underlying API method. 19 domain tools (mirroring the publisheddocumentation categories) cover every endpoint without flooding the IDE tool list.
• Full CISO Assistant surface — Analytics & Metrology, Assets, Authentication& Users, Compliance, EBIOS-RM, Evidence & Attachments, Frameworks & Libraries,Governance, Incidents, Integrations, Privacy, Quantitative Risk (CRQ),Resilience, Risk Management, Security Exceptions & Findings, Settings, Tasks &Timeline, and Third-Party Risk Management.
• Knox token auth — a pre-minted Knox token or a username/password pairexchanged for a token at POST /api/iam/login/, plus OIDC delegation (RFC 8693)via agent-utilities.
• Resilient — honours 429 Retry-After, retries transient 5xx, andtransparently follows DRF next pagination links.

MCP

Using as an MCP Server

The MCP Server runs in stdio (local) or streamable-http (networked) mode.Each domain is a tool gated by a {TAG}TOOL environment variable (default True),so you can scope the surface (e.g. set CHATTOOL=False to drop the chat domain).

Environment Variables

Package environment variables

Inherited agent-utilities variables (apply to every connector)

8 package + 21 inherited variable(s). Auto-generated from .env.example + the shared agent-utilities set — do not edit.

The server also reads the standard MCP-transport, telemetry, governance, and agent-CLIvariables:

Run in stdio mode (default):

export CISO_ASSISTANT_URL="https://ciso.arpa"
export CISO_ASSISTANT_TOKEN="your_token"
ciso-assistant-mcp --transport "stdio"

Run in HTTP mode:

export CISO_ASSISTANT_URL="https://ciso.arpa"
export CISO_ASSISTANT_TOKEN="your_token"
ciso-assistant-mcp --transport "streamable-http" --host "0.0.0.0" --port "8000"

Available MCP Tools

Auto-generated — do not edit (synced by the mcp-readme-table pre-commit hook).

20 action-routed tools (default MCP_TOOL_MODE=condensed). Each is enabled unless its toggle is set false; set MCP_TOOL_MODE=verbose (or both) for the 1:1 per-operation surface. Auto-generated — do not edit.

A2A Agent

Run A2A Server

export CISO_ASSISTANT_URL="https://ciso.arpa"
export CISO_ASSISTANT_TOKEN="your_token"
ciso-assistant-agent --provider openai --model-id gpt-4o --api-key sk-...

Docker

Build

docker build -t ciso-assistant-api .

Run MCP Server

docker run -d \
  --name ciso-assistant-api \
  -p 8000:8000 \
  -e TRANSPORT=http \
  -e CISO_ASSISTANT_URL="https://ciso.arpa" \
  -e CISO_ASSISTANT_TOKEN="your_token" \
  knucklessg1/ciso-assistant-api:mcp

The :mcp tag is the slim MCP-server image (built fromdocker/Dockerfile --target mcp, installing ciso-assistant-api[mcp]). The default:latest tag is the full agent image (--target agent, ciso-assistant-api[agent])which also bundles the Pydantic AI agent and the epistemic-graph engine — use itwhen you run ciso-assistant-agent (the agent), not just the MCP server. SeeContainer images.

Deploy with Docker Compose

services:
  ciso-assistant-api:
    image: knucklessg1/ciso-assistant-api:mcp
    environment:
      - HOST=0.0.0.0
      - PORT=8000
      - TRANSPORT=http
      - CISO_ASSISTANT_URL=https://ciso.arpa
      - CISO_ASSISTANT_TOKEN=your_token
    ports:
      - 8000:8000

Configure mcp.json for AI Integration (e.g. Claude Desktop)

Install the slim [mcp] extra. The example below installsciso-assistant-api[mcp] — the MCP-server extra that pulls only the FastMCP /FastAPI tooling (agent-utilities[mcp]). It deliberately excludes the heavyagent runtime (the epistemic-graph engine, pydantic-ai, dspy, llama-index,tree-sitter), so uvx/container installs are dramatically smaller and faster.Use the full [agent] extra only when you need the integrated Pydantic AI agent(see Installation).

{
  "mcpServers": {
    "ciso_assistant": {
      "command": "uv",
      "args": [
        "run",
        "--with",
        "ciso-assistant-api[mcp]",
        "ciso-assistant-mcp"
      ],
      "env": {
        "CISO_ASSISTANT_URL": "https://ciso.arpa",
        "CISO_ASSISTANT_TOKEN": "your_token"
      }
    }
  }
}

Install Python Package

Pick the extra that matches what you want to run:

# MCP server only (recommended for tool hosting — slim deps)
uv pip install "ciso-assistant-api[mcp]"

# Full agent runtime (Pydantic AI + epistemic-graph engine)
uv pip install "ciso-assistant-api[agent]"

# Everything (development)
uv pip install "ciso-assistant-api[all]"      # or: python -m pip install "ciso-assistant-api[all]"

Container images (:mcp vs :agent)

One multi-stage docker/Dockerfile builds two right-sized images, selected by --target:

docker build --target mcp   -t knucklessg1/ciso-assistant-api:mcp    docker/   # slim MCP server
docker build --target agent -t knucklessg1/ciso-assistant-api:latest docker/   # full agent

docker/mcp.compose.yml runs the slim :mcp server; docker/agent.compose.yml runs theagent (:latest) with a co-located :mcp sidecar.

Knowledge-graph database (epistemic-graph)

The full agent ([agent] / :latest) embeds the epistemic-graph engine (pulled intransitively via agent-utilities[agent]). For production — or to share one knowledge graphacross multiple agents — run epistemic-graph as its own database container and point theagent at it instead of embedding it. Deployment recipes (single-node + Raft HA), connectionconfig, and the full database architecture (with diagrams) are documented in theepistemic-graph deployment guide.The slim [mcp] server does not require the database.

Documentation

The complete documentation is published as theofficial documentation site and isthe source of truth for installation, usage, and deployment.

Repository Owners

Deploy with agent-os-genesis

This package can be provisioned for you — skill-guided — by the agent-os-genesisuniversal skill (its single-package deploy mode): it picks your install method, seedssecrets to OpenBao/Vault (or .env), trusts your enterprise CA, registers the MCPserver, and verifies it — the same machinery that stands up the whole Agent OS, narrowedto just this package. Ask your agent to "deploy ciso-assistant-api with agent-os-genesis".

Secrets are read-existing + seeded via vault_sync — you are only prompted for what's missing.