Coso MCP is listed as active in the registry but did not answer our last check. 43 installs a week from npm. It exposes 39 tools. Last commit 23 Oct 2026.
Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.
Installs per day
peak 472 · avg 17 · -91% w/w
a month agotoday
Uptime history
12 days of history · worst day 0%
12 days agonow
0.0%
Uptime 24h
0 of 91 checks
39
Tools
read from the server
1351 ms
Response time
average over 24h
43
Installs / week
npm and PyPI
What the code does
We read the source, 2 d ago · tools taken from the live server · rules 995398eba69f
Capabilities
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
Builds a file path from a variable
src/store/file-store.ts:37
const dir = path.join(root, id);
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 5 min ago.
run in your terminal
claude mcp add coso-mcp --transport http https://internal-control.ascent-partners.com/mcpSettings → Connectors → Add custom connector, then paste this address
https://internal-control.ascent-partners.com/mcp~/.codex/config.toml
[mcp_servers.coso-mcp]
url = "https://internal-control.ascent-partners.com/mcp".cursor/mcp.json
{
"mcpServers": {
"coso-mcp": {
"url": "https://internal-control.ascent-partners.com/mcp"
}
}
}.vscode/mcp.json
{
"servers": {
"coso-mcp": {
"type": "http",
"url": "https://internal-control.ascent-partners.com/mcp"
}
}
}Available tools 39
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
assess
assess_component
Report coverage indicators for one COSO component, aggregating its principles.
assess_principle
Report data-driven coverage indicators for one COSO principle (controls, risks and deficiencies mapped to it).
engagement
create_engagement
Create a new internal-control review engagement. Returns the engagement id used by all later tools.
get_engagement
Return an engagement by id.
register
register_control
Register a key control with its type, frequency, linked risks, assertions and COSO principles.
register_risk
Register a risk to objectives, with likelihood, assertions, related COSO principles and a fraud flag.
scope
add_scope_item
Add a significant account/process to the review scope, with its objective category and assertions.
list_scope_items
List the scope items for an engagement.
activity
get_activity_log
Return the append-only activity log for an engagement, plus a Markdown rendering.
aggregate
aggregate_deficiencies
Group related deficiencies by control, flag combinations that may aggregate, and report the overall severity.
assemble
assemble_workpaper
Assemble a Markdown control-testing workpaper from the control, its risks, population, sample, test results and exceptions.
assertions
list_assertions
List the assertions used to frame control objectives: completeness, existence/occurrence, accuracy, valuation, obligations/rights, presentation/disclosure.
audit
get_audit_log
Return the append-only audit events recorded for an engagement.
classify
classify_deficiency
Classify a control deficiency as deficiency / significant deficiency / material weakness from likelihood × magnitude (escalates for a pervasive control).
component
get_component
Return a single COSO component by id, with its principles.
components
list_components
List the five components of the COSO Internal Control—Integrated Framework (ICIF-2013).
compute
compute_sample_size
Recommend a sample size for a control from its frequency, risk and population size, with a documented rationale.
controls
list_controls
List the controls registered for an engagement.
deficiencies
list_deficiencies
List the deficiencies recorded for an engagement.
engagements
list_engagements
List all engagement ids and titles.
exceptions
list_exceptions
List the exceptions recorded for an engagement.
framework
framework_integration_check
Check that all five COSO components have some recorded coverage and that principles are addressed.
generate
generate_report
Generate a Markdown internal-control review report: scope, risks, controls, testing, workpapers, deficiencies and COSO coverage.
note
note_exception
Record an exception identified during testing, with root cause, impact and any compensating control.
objective
list_objective_categories
List the three COSO objective categories (operations, reporting, compliance).
population
create_population
Register the population for a control — either an explicit item list or a declared size. Bounded to 10000 items.
populations
list_populations
List the populations registered for an engagement.
principle
get_principle
Return a single COSO principle by framework number or slug, including its paraphrased points of focus.
principles
list_principles
List the 17 principles of the COSO ICIF-2013, optionally filtered to a single component.
record
record_test_result
Record attribute-level outcomes (pass/fail/na) for a tested sample, with an optional conclusion.
resolve
resolve_review_note
Mark a review note resolved on a workpaper.
review
add_review_note
Add a reviewer note to a workpaper.
risks
list_risks
List the risks registered for an engagement.
select
select_sample
Select a reproducible sample from a population. Seeded (deterministic) for random/systematic/haphazard; targeted takes explicit references. Records the method, seed and references.
server
get_server_info
Return the server identity, the COSO framework it covers, and the mandatory disclaimer.
sign
sign_off
Record a preparer or reviewer sign-off. Warns (does not block) if the same person prepared and reviewed.
test
list_test_results
List the test results recorded for an engagement.
workpaper
get_workpaper
Return a workpaper including its rendered Markdown.
workpapers
list_workpapers
List the workpapers assembled for an engagement.
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://internal-control.ascent-partners.com/mcp | streamable-http | answering | 1351 ms | 5 min ago |
Alternatives to Coso MCP
same job, measured the same wayRqwstr
by kjopstad-it
AI-native HTTP security testing MCP server — 17 tools with raw HTTP/1.1 + HTTP/2 control
C
Cortex Test MCP Server
by sasikumarlilly
Internal test MCP server for local dev and Bifrost integration testing.
Mifid Ii AI MCP
by csoai-org
MiFID II Article 17 algorithmic trading + RTS 6 testing/risk controls + best execution AI compli...
T
Tern
by zyf8827
Model Context Protocol (MCP) server for Tern E2E testing platform
E
Elias MCP Sample Server
by elpadev
A sample MCP server for testing
MCP Rating
by mcprating
Search MCP servers, with our own start-test results, required keys, tools and token cost.
pagent
by aihumin
A/B testing MCP server for pagent: create, run and review A/B tests on your live website.
Quantrisk
by 78degrees
Portfolio risk analytics MCP server — VaR, Monte Carlo, stress testing, and more.
Coso MCP — questions
Answers built from our own checks of this server.
What can Coso MCP do?
It exposes 39 tools, read directly from the server on our last check. Among them: add_review_note, add_scope_item, aggregate_deficiencies, assemble_workpaper, assess_component, assess_principle and 33 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README.
How MCP servers expose tools in the first place →
What is Coso MCP mostly used for?
Its tools cluster around register, scope and assess. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.
Is Coso MCP working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 0 of 91 checks got a reply (0.0%), average response time 1351 ms. The bar chart above shows every period we have measured.
The registry lists Coso MCP as active — why does it not respond?
The official MCP registry stores what the author submitted; it does not verify that the server still runs. We check the endpoint ourselves, and this one does not answer. Catalogues that copy the registry without checking will show it as working.
How do I connect Coso MCP?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Coso MCP need an API key?
No. Coso MCP completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 39 of them are readable on this page. This is what we observed, not what the docs claim.
How many people use Coso MCP?
The npm package @simonmak-ascent/coso-mcp was installed 43 times in the last week. Week over week that is -91%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Coso MCP open source?
The code is open source: it is published under the MIT licence, written in TypeScript and 0 stars on GitHub. The licence covers the code in the repository, not the hosted service at internal-control.ascent-partners.com, which runs on its operator's own terms.