The journey toward continuous compliance has evolved from static checklists to dynamic, code‑centric practices.
Early efforts focused on translating regulatory language into spreadsheet matrices, a process that proved brittle as environments changed.
The introduction of OSCAL (Open Security Controls Assessment Language) shifted the paradigm by encoding controls, profiles, and system descriptions in machine‑readable JSON, enabling version control, automated testing, and seamless integration into DevOps pipelines.
Despite the promise of “compliance as code,” many organizations found themselves bottlenecked by the need for specialized CLI expertise.
Teams spent valuable hours memorizing Trestle sub‑commands, debugging argument syntax, and maintaining scripts that were fragile and poorly documented.
This technical barrier limited participation to a small subset of security engineers, leaving domain experts—regulators, policy writers, and auditors—on the sidelines.
Recognizing this friction, the OSCAL Compass community sought a solution that would democratize access to OSCAL artifacts without sacrificing the rigor of automated pipelines.
The breakthrough came not from another wrapper script, but from embracing an emerging standard for AI‑mediated tool interaction: the Model Context Protocol (MCP).
By exposing Trestle operations as discoverable, self‑describing tools, MCP enables any AI‑assisted interface to invoke complex compliance workflows through natural language, effectively turning the command line into a conversational interface.
Historically, each stakeholder in the compliance ecosystem faced a steep learning curve before they could meaningfully contribute to OSCAL artifacts.
Regulators receiving updates to NIST 800‑53 or the EU AI Act had to rely on technical staff to import raw JSON, generate markdown for review, and re‑export changes—a process that obscured the policy intent behind layers of command‑line flags.
The Model Context Protocol addresses this challenge by defining a uniform JSON‑RPC layer through which AI models can discover and invoke tools exposed by servers.