Loading…
Query 692+ compliance frameworks, 13,700+ controls, and 280K+ cross-framework mappings.
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The TheArtOfService Compliance Intelligence MCP server exposes 23 tools, focused primarily on general-purpose capabilities. Its published description reads: "Query 692+ compliance frameworks, 13,700+ controls, and 280K+ cross-framework mappings". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates TheArtOfService Compliance Intelligence D — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check TheArtOfService Compliance Intelligence's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add TheArtOfService Compliance Intelligence to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.theartofservice.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Search the course catalogue Find courses by need, framework, role or industry. Free-text search over the catalogue, optionally narrowed to a named standard. Examples: q='soc 2 evidence collection', q=
Get one course Full detail for a single course by product id, including every standard it covers and its purchase URL. Use after agent_search_courses to justify a recommendation. No authentication req
Find courses covering several standards at once Given two or more standards, returns courses that address ALL of them together, which is what an organisation running overlapping programmes actually ne
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: agent_get_course
A tool description tries to alter the model’s use of another tool.
URL. Use after agent_search_courses to justify a recommendation. No authenticationRecommendationDescriptions must describe only their own tool.
tool: agent_get_framework
A tool description tries to alter the model’s use of another tool.
as returned by agent_search_frameworks. ### Responses: **200**: Successful ResponseRecommendationDescriptions must describe only their own tool.
tool: agent_get_framework_controls_by_name
A tool description tries to alter the model’s use of another tool.
ment. Use this whenever the framework name contains a forward slash. 84 oRecommendationDescriptions must describe only their own tool.
tool: agent_cross_framework_map
A tool description tries to alter the model’s use of another tool.
as returned by agent_search_frameworks. ### Responses: **200**: Successful ResponseRecommendationDescriptions must describe only their own tool.
tool: agent_list_crosswalk_pairs
A tool description tries to alter the model’s use of another tool.
all this before agent_coverage_crosswalk to find out which pairs return a number. A paiRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: agent_courses_for_frameworks
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "agent_courses_for_frameworks"RecommendationScope tools to the minimum needed.
tool: agent_buy_review
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "agent_buy_review"RecommendationScope tools to the minimum needed.
Financial data service providing fundamental information for 30,000+ listed companies across the US, Japan, and Korea, sourced directly from SEC, EDINET, and DART regulatory filings.
Search tours, attraction tickets, and holiday packages across 24 countries.
Agentic visitor analytics with five tools for CRO and session analysis.
52 paid x402 API endpoints for AI agents — crypto, data, DeFi, and market intelligence, settled on Base.
Access Vonage API documentation, code snippets, tutorials, and troubleshooting resources.
List standards the catalogue covers Every standard that has courses, with a course count each. Use this to discover valid values for the framework filter before searching. No authentication required.
Search and list compliance frameworks Search the compliance knowledge graph for frameworks by name, keyword, or jurisdiction. Returns framework metadata including name, description, jurisdiction, doma
Get detailed information about a compliance framework Returns comprehensive details about a specific compliance framework: description, jurisdiction, version, domains with control counts, and cross-fr
Get all controls for a compliance framework Returns all controls belonging to a framework, optionally filtered by domain. Each control includes: code, title, description, and domain. For large framewo
Get all controls for a framework, naming it as a query parameter Identical to agent_get_framework_controls, taking the framework name as a query parameter instead of a path segment. Use this whenever
Get detailed information about a specific control Returns full details for a single control by its code identifier: title, description, domain, and framework. Control codes are framework-specific (e.g
Get cross-framework mappings for a control Returns all controls in other frameworks that map to the given control via MAPS_TO relationships. This is the core cross-framework mapping capability: use it
Map controls between two compliance frameworks Returns the complete control-to-control mapping between a source and target framework. Each mapping shows which source control maps to which target contr
Get cross-framework coverage report for a framework Returns a coverage analysis showing how many controls in the given framework map to controls in every other framework. Includes total controls, mapp
Full-text search across controls and frameworks Search the compliance knowledge graph using full-text search. Type 'controls' searches control titles and descriptions. Type 'frameworks' searches frame
Get platform statistics Returns current platform statistics: total framework count, control count, cross-framework mapping count, and domain count. No authentication required. ### Responses: **200**:
Get API pricing and rate limit information Returns current API pricing tiers, monthly call limits, and (if authenticated) your current month's usage. Use this to understand costs before making API cal
What one framework already evidences of another Given a framework you already hold and one you are working toward, returns which of the target's controls your existing evidence already covers, which r
How do you know this: the grounding behind a crosswalk's claims For any released framework pair, return the reasoning and the provenance behind its mappings: what document each control was verified ag
Everything about one crosswalk pair, including what was rejected One framework pair in full: the coverage percentage and how it was arrived at, a sample of the claims that held with the reasoning behi
What was claimed and did not hold, with the reason The mappings that were proposed for a pair and then refuted, each with why it failed. Refuted mappings are kept in the graph rather than deleted, so
What everything you already hold covers, together Give the frameworks an organisation already holds and one it needs. Returns what they cover TOGETHER, what each one adds that the others do not, and w
Get a checkout link for a crosswalk report Returns a payment link for the crosswalk between two frameworks. Released pairs are delivered immediately on payment; any other pair is built to order at the
Get a checkout link for a single document compliance review Returns a payment link for a Single Document Compliance Review against one framework. On payment the buyer is emailed a single-use link that
Framework pairs with a released coverage crosswalk Lists the framework pairs that have a reviewed, signed-off coverage crosswalk, with the coverage figure for each. Call this before agent_coverage_cro