Skip to content

From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure

🕒 Published (v1): 2026-07-09 09:32 UTC · Source: Arxiv · link

Why this paper was selected

MCP-based multi-agent pipeline for compliance — concrete agentic scaffold on Model Context Protocol for critical infrastructure

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This paper presents an eight-phase, non-invasive multi-agent pipeline that transforms unstructured natural-language system descriptions of critical infrastructure into audit-ready NIST OSCAL artifacts (System Security Plan + Security Assessment Report). The pipeline grounds LLM reasoning through 15 MCP servers that query authoritative CTI sources deterministically, shifting hallucination risk from distributed LLM inference to a single, human-reviewable entity-extraction step. On a synthetic water utility scenario it achieves 0.90 CVE recall, 1.00 D3FEND recall, and 0% factual hallucination rate on deterministically sourced knowledge-graph nodes.

Problem

Operational technology (OT) environments in critical infrastructure cannot tolerate active scanning, yet defenders need structured risk assessments and machine-readable compliance artifacts. Existing AI tools hallucinate CVE identifiers, CVSS scores, and attack paths — errors that are undetectable without ground-truth scanning. Meanwhile, regulatory frameworks (NIS-2, BSI Grundschutz++) now require structured OSCAL-format compliance evidence, but operators possess only unstructured legacy documentation. No prior work bridges unstructured natural-language OT descriptions, deterministic CTI retrieval, and OSCAL-validated audit artifacts.

Method

The pipeline is a directed, eight-phase graph-based Multi-Agent System (MAS) with strict separation between probabilistic LLM phases (0, 0b, 3b, 5, 6) and deterministic phases (1, 2, 3a, 4):

  • Phase 0 — LLM agent extracts entities (vendor, version, Purdue-level role, criticality, exposure) from text and a Shodan report; serializes them into an OSCAL SSP.
  • Phase 1 — Deterministic CVE discovery via mcp-nvd, CPE-normalized lookups, ICS-CERT advisory queries, alias CPE expansion, and keyword fallback; each CVE annotated with a confidence score (1.0–0.5).
  • Phase 2 — Scores every CVE with the Critical Infrastructure Relevance Heuristic (CRH): $\(U = (S_{\text{base}} \times M_{\text{context}}) + B_{\text{threat}}\)$ where \(S_{\text{base}} = \max(\text{CVSS}, 5.0)\), \(M_{\text{context}} = C_{\text{crit}} \times E_{\text{exp}}\) (Purdue-model criticality × exposure), and \(B_{\text{threat}} = \text{EPSS} \times 5 + 5 \cdot \mathbf{1}[\text{CVE} \in \text{KEV}]\).
  • Phase 3a/3b — Deterministic triage by urgency thresholds and KEV override; LLM rehabilitation re-evaluates discarded CVEs against CPE metadata and EOL status.
  • Phase 4 — Taxonomy chain expansion to depth Entity→CVE→CWE→CAPEC→ATT&CK→D3FEND via dedicated MCP servers (ATT&CK ICS, EMB3D, D3FEND).
  • Phases 5–6 — LLM relevance review and SAR generation with OSCAL schema validation.

MCP tool-use replaces RAG vector search: agents invoke pre-defined API functions returning structured JSON, making retrieval binary-verifiable rather than probabilistically approximate.

Key Contributions

  • An eight-phase MCP-grounded multi-agent pipeline converting unstructured OT documentation to schema-valid OSCAL SSP and SAR without active scanning.
  • The Critical Infrastructure Relevance Heuristic (CRH): a transparent, additive, OT-contextualized urgency index combining CVSS, EPSS, KEV, Purdue-model asset criticality, and network exposure — designed to prioritize recall over precision for safety-critical triage.
  • Empirical demonstration that MCP-based deterministic retrieval localizes hallucination to Phase 0 entity extraction, making residual errors visible and manually reviewable.
  • 15-server MCP integration spanning vulnerability foundations (NVD, CPE, US-CERT, ICS-CERT, OpenCVE), risk filters (KEV, EPSS), passive recon (Shodan), threat taxonomies (ATT&CK Enterprise/ICS, EMB3D, CAPEC, CWE), defense mapping (D3FEND), and lifecycle (EOL).

Results

  • CVE Recall: 0.90 (stable across 5 runs) against a manually verified ground truth of 292 CVEs across 8 assets in the WaterWork water-utility scenario.
  • D3FEND Recall: 1.00 — all defensive countermeasures for relevant attack techniques retrieved.
  • Factual Hallucination Rate: 0% for all deterministically sourced KG nodes.
  • Semantic Hallucination Rate: 12.5% in LLM-based entity extraction (Phase 0).
  • Contextual False Positive Rate: 8.5% — quantifies error propagation from incorrectly extracted entities into the deterministic retrieval stages (genuine but irrelevant CVEs).
  • Output artifacts pass NIST OSCAL JSON schema validation without errors across all runs.
  • No explicit baseline comparison against alternative pipelines is reported; evaluation is against the manually verified ground truth dataset.

Limitations

  • Evaluated on a single synthetic scenario (one water utility); generalizability to other OT sectors or network topologies is unvalidated.
  • Semantic Hallucination Rate of 12.5% in Phase 0 entity extraction propagates real but irrelevant CVEs into downstream phases, consuming compute and requiring manual review.
  • CRH constants (thresholds, multipliers) are empirically derived for this scenario; no gold standard for OT vulnerability prioritization exists, and the values may not generalize.
  • Shodan data is simulated as textual input rather than live API integration; production deployment of the Shodan MCP stream is not tested.
  • CVE recall ceiling is constrained by MCP API coverage gaps (missing data is the primary error class in deterministic phases, not hallucination).
  • No adversarial evaluation of MCP server integrity or tool-poisoning resistance, despite the paper citing such attack surfaces in related work.
  • Phase 4 taxonomy expansion is capped at top 25 CVEs and 20 chains per CVE, potentially missing low-urgency but strategically significant attack paths.

Relevance to Agentic AI / LLM Agents

This work is a concrete, domain-deployable instantiation of the MCP-as-grounding-layer design pattern for agentic systems: it demonstrates empirically how replacing probabilistic RAG retrieval with deterministic tool-call APIs shifts the error distribution from diffuse hallucination across all pipeline stages to a single, bounded, human-auditable failure point. For researchers tracking LLM agents, the pipeline illustrates a practical architecture for decoupling LLM reasoning from factual retrieval in high-stakes settings — a general principle applicable beyond security to any domain requiring verifiable, structured knowledge. The paper also surfaces a key agentic failure mode: entity extraction errors in the first phase propagate as "genuine but wrong" inputs through otherwise correct deterministic stages, a causal contamination pattern relevant to any multi-step agentic workflow that ingests unstructured text.