From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure

Jul 16, 2026

Upload by Aurelia

Critical infrastructure operational technology often cannot be actively scanned, yet continuous risk assessment and compliance still require evidence. This paper introduces a non-invasive, MCP-grounded multi-agent pipeline that converts natural-language system descriptions into source-verified knowledge graphs and audit-ready artifacts in NIST OSCAL. The design decouples LLM reasoning from deterministic retrieval against authoritative threat intelligence, reducing fabricated vulnerabilities and hallucinated attack paths. In a water-utility scenario, the pipeline achieves 0.90 CVE recall and perfect D3FEND recall, producing schema-valid System Security Plan and Security Assessment Report outputs.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages8

Reading Time20 min

Abstract

Index Terms

Introduction

Motivation and problem context

Proposed solution overview

From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure Lea Muth Department of Mathematics and Computer Science Freie Universitt Berlin Berlin, Germany [Lea.Muth@fu-berlin.de](Lea.Muth@fu-berlin.de) Marian Margraf Department of Mathematics and Computer Science Freie Universitt Berlin Berlin, Germany [Marian.Margraf@fu-berlin.de](Marian.Margraf@fu-berlin.de) arXiv :2607 .08288v 1 [ cs .CR] 9 Jul 2026 Abstract—In critical infrastructure, operational technology environments often cannot be actively scanned, and yet active system feedback is needed for risk assessment and compliance. This paper presents a non-invasive, MCP-grounded multi-agent pipeline that converts natural-language system descriptions into source-verified knowledge graph and audit-ready artifacts in the NIST OSCAL format for continuous automated compliance management. The architecture decouples LLM-based reasoning from deterministic knowledge retrieval against authoritative threatintelligence sources, reducing the risk of fabricated vulnerabilities and hallucinated attack paths. In an evidence-based synthetic scenario of a water utility, the pipeline achieves 0.90 CVE recall and perfect D3FEND recall. It generates a schema-valid OSCAL System Security Plan and an OSCAL Security Assessment Report. Nevertheless, the core insight is not that grounding via MCP eliminates errors (e.g., hallucinations) entirely from the pipeline, but that it shifts errors into the first phase of asset extraction from the natural language description. Here, a single incorrectly extracted entity can lead to genuine but irrelevant CVEs in subsequent stages of the pipeline, which consumes time and resources. However, it makes the remaining risk visible, verifiable, and suitable for a timeefficient manual review, since the infrastructure (e.g., version numbers, OS, etc.) is typically known. Index Terms—BSI Grundschutz, compliance as code, Industrial Control Systems, Cyber Threat Intelligence (CTI), Model Context Protocol (MCP), Open Security Controls Assessment Language (OSCAL) I. INTRODUCTION In mid-September 2025, the global cybersecurity landscape underwent a significant tactical escalation. Anthropic’s Threat Intelligence team disclosed a sophisticated AI-orchestrated espionage campaign, presumably executed by the statesponsored group GTG-1002 [1] . For the first time in documented history, threat actors leveraged an autonomous framework based on Anthropic’s Claude Code and the Model Context Protocol (MCP) to execute complex cyber operations with © 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. minimal human intervention (80%-90% automated tactical operations), demonstrating that the primary threat of AI lies not in generating novel zero-day exploits, but in accelerating the overall attack lifecycle [1] . This acceleration poses a severe systemic risk to critical infrastructure, where the defensive posture is often constrained by operational technology. critical infrastructure sectors such as energy and water management rely on legacy Industrial Control Systems (ICS) with life cycles that span decades. Given the fragility of these legacy operational technology environments, standard security measures (e.g., active vulnerability scanning) pose unacceptable availability risks [26] . Consequently, while attackers already use Multi-Agent Systems with MCP, defenders still lack real-time visibility and often rely on fragmented static asset documentation. While AI-powered tools promise to close this gap, they also introduce fundamental reliability problems, as they h

FAQs

Why is threat-informed continuous compliance difficult in critical infrastructure operational technology?

Operational technology in critical infrastructure often cannot be actively scanned, so defenders lack real-time visibility. They also face reliability issues such as hallucinated CVEs/CVSS and fabricated attack paths when using AI tools, while regulators demand rigorous, well-documented risk management.

How does the proposed pipeline reduce hallucinations when generating OSCAL artifacts?

The pipeline grounds agent reasoning with MCP and uses deterministic knowledge retrieval against authoritative CTI sources. This decouples LLM-based reasoning from retrieval and iteratively enriches a knowledge graph before converting it into OSCAL artifacts.

What outputs does the pipeline generate for compliance workflows?

It produces schema-valid NIST OSCAL artifacts, specifically a System Security Plan and a Security Assessment Report, derived from the enriched knowledge graph built from the natural-language description.

Jul 16, 2026

Upload by Aurelia