Skip to content

Compliance

compliance — mvp.compliance

Cluster: Core Infrastructure | Type: component | MCP Tools: 42

Overview

Compliance evidence tracker for SOC 2 and ISO 27001 control libraries. The core block provides fast stateless control-reference lookups backed by in-memory seed data, while the MCP block adds SQLite persistence for evidence, findings, assessments, and cross-framework control mapping.

MVP compliance caveat

This component is useful for organising evidence, identifying gaps, and producing pilot-ready audit-trail artifacts. It does not certify legal, regulatory, SOC 2, ISO 27001, HIPAA, GDPR, clinical, financial, or other regulated-industry compliance. Its scores indicate evidence coverage under the component's current model, not an auditor-approved compliance determination. Production use in regulated domains requires human review, validated evidence, jurisdiction-specific controls, and external legal or compliance assessment.

When to use:

  • Verifying that a control reference exists in the built-in SOC 2 or ISO 27001 seed data
  • Tracking submitted evidence and findings against controls during pilots
  • Generating evidence coverage reports, gap analyses, and draft statements of applicability (SOA)
  • Mapping controls across frameworks, for example SOC 2 CC6.1 to ISO 27001 5.15

Example:

from mvp.compliance import ComplianceBlock, ComplianceInput

block = ComplianceBlock(name="compliance")
result = block.infer(ComplianceInput(
    framework_type="soc2",
    control_ref="CC6.1",
    check_type="exists",
))
# result.ok -> True; result.value.details -> str
# NOTE: an `exists` check reports REFERENCE EXISTENCE only -> compliant is False
# ("reference existence is not compliance proof"). compliant=True requires an
# executed legal-reviewed RuleEngine.evaluate run (check_type="enforce_with_evidence")
# or fresh validated evidence with no open critical/high findings.

Works well with: csf, align_csf, formal_methods

Public API

ComplianceBlock(AIBlock[ComplianceInput, ComplianceOutput, None])

Stateless compliance check using in-memory seed data.

Field Type Default
name str 'compliance'
resource_bounds ResourceBounds \| None None
usage ResourceUsage field(default_factory=ResourceUsage)

Methods:

infer(data: ComplianceInput) -> Result[ComplianceOutput]

ComplianceInput(BaseModel)

Input to ComplianceBlock.

Field Type Default
framework_type Literal['soc2', 'iso27001'] required
control_ref str required
check_type Literal['exists', 'has_evidence', 'has_finding', 'enforce_with_evidence', 'verify_evidence'] 'exists'

ComplianceOutput(BaseModel)

Output from ComplianceBlock.

Field Type Default
compliant bool required
details str required
control_ref str required
degraded bool False
degradation_reason str ''
completion_state str ''
reliability_label str ''
warning_card dict[str, Any] \| None None
evidence list[dict[str, Any]] Field(default_factory=list)
request_id str ''
task_id str ''
run_id str ''
code str ''
certified bool False
legal_reviewed bool False
envelope dict[str, Any] Field(default_factory=dict)

ComplianceMCPBlock(AIBlock[MCPComplianceInput, MCPComplianceOutput, dict])

Full-featured compliance block with SQLite persistence.

Field Type Default
name str 'compliance_mcp'
state dict \| None None
db_path str ':memory:'
resource_bounds ResourceBounds \| None None
usage ResourceUsage field(default_factory=ResourceUsage)

Methods:

infer(data: MCPComplianceInput) -> Result[MCPComplianceOutput]

MCPComplianceInput(BaseModel)

Input for ComplianceMCPBlock — all 25 ops.

Field Type Default
op ComplianceOp required
name str ''
version str ''
description str ''
framework_type str ''
framework_id str ''
seed_builtin bool False
control_id str ''
source_control_id str ''
target_control_id str ''
control_ref str ''
title str ''
category str ''
guidance str ''
evidence_id str ''
evidence_type str ''
submitted_by str ''
valid_until str ''
control_ids list[str] Field(default_factory=list)
include_expired bool False
assessment_id str ''
scope str ''
assessed_by str ''
finding_id str ''
severity str ''
remediation str ''
status str ''
resolution_notes str ''
source_framework_id str ''
target_framework_id str ''
auto_map bool False
mapping_type str 'related'
include_evidence bool False
include_findings bool False
query str ''
limit int 50
entity_type str ''
entity_id str ''

MCPComplianceOutput(BaseModel)

Output from ComplianceMCPBlock.

Field Type Default
op str required
ok bool True
message str ''
data dict[str, Any] Field(default_factory=dict)
records list[dict[str, Any]] Field(default_factory=list)
count int 0
degraded bool False
degradation_reason str ''

Functions

list_patterns() -> dict[str, Any]

Return the compliance applied-pattern + skill surface.

MCP Tools

Operation Source
ops compliance_mcp
help compliance_mcp
create_framework compliance_mcp
get_framework compliance_mcp
list_frameworks compliance_mcp
delete_framework compliance_mcp
update_control compliance_mcp
create_control compliance_mcp
get_control compliance_mcp
list_controls compliance_mcp
delete_control compliance_mcp
search_controls compliance_mcp
submit_evidence compliance_mcp
get_evidence compliance_mcp
list_evidence compliance_mcp
validate_evidence compliance_mcp
link_evidence compliance_mcp
run_assessment compliance_mcp
get_assessment compliance_mcp
list_gaps compliance_mcp
create_finding compliance_mcp
update_finding compliance_mcp
create_assessment compliance_mcp
get_audit_log compliance_mcp
has_evidence compliance_mcp
has_finding compliance_mcp
list_open_findings compliance_mcp
get_last_assessment_date compliance_mcp
compliance_score compliance_mcp
generate_report compliance_mcp
export_soa compliance_mcp
map_controls compliance_mcp
create_mapping compliance_mcp
list_mappings compliance_mcp
get_control_by_ref compliance_mcp
soc2 compliance_mcp
iso27001 compliance_mcp
info compliance_mcp
exists compliance_mcp
enforce_with_evidence compliance_mcp
verify_evidence compliance_mcp
capabilities compliance_mcp