An organisation certified against one framework and pursuing a second spends most of its effort on the overlap, and the two useful views of that overlap point opposite ways: the auditor wants the gaps, the sponsor wants the coverage percentage. Serving both from the same mapping without conflating them is the right shape. search_controls across all frameworks is the other tool doing real work — a requirement like encryption at rest appears in a dozen frameworks under a dozen names, and finding all of them is otherwise a manual survey. The advisory tool is a generated answer rather than a citation, so treat it as a starting point rather than as the position you defend to an assessor.
A compliance-framework client built around the cross-framework problem: eight tools covering framework discovery, control listing, mapping between frameworks, gap and coverage analysis, and an advisory query.
- search_frameworks finds frameworks by subject rather than by exact name, and get_framework opens one with its detail.
- get_framework_controls lists a framework's controls, and search_controls searches across every framework's controls at once — which is how you find where a specific requirement appears.
- cross_framework_map shows which controls in the source framework correspond to which in the target, the join that certification work runs on.
- gap_analysis returns what the target framework requires that the source does not cover, and coverage_report says how well a framework's controls are mapped — two directions of the same question.
- advisory_query answers a compliance question directly rather than returning documents.
A TheArtOfService API key sent as an Authorization bearer header.
One command plus a key — npx -y @theartofservice/compliance-mcp, then supply credentials