Query the corpus over MCP.
One read-only Model Context Protocol server — apeiris-mcp — lets an agent ask the whole Apeiris corpus real questions instead of scraping: the pinned MITRE ATLAS model, the knowledge graph (3,784 nodes / 36,514 edges), the evidence + obligation layer, the knowledge-object layer (incidents, vendors, per-control neighborhoods), the deterministic reasoning layer, and the corpus-generated research layer. 42 tools in six groups, one governed interface. stdio JSON-RPC (protocol 2024-11-05), zero-dependency, in the platform repo's adapters/apeiris-mcp/.
Four guarantees, enforced in code.
These are the properties the adapter tests hold true — the reason to use the server instead of fetching the JSON yourself.
The server never writes the corpus. The ATLAS refresh (sync) is a separate, review-gated CLI step — not exposed as a tool.
On start it verifies the manifest's own Ed25519 signature against the published trust anchor — refusing to serve a tampered manifest even if every artifact matches its poisoned pin — and each artifact's SHA-256 against its manifest pin.
Each response carries its source: the corpus version, ATLAS release tag / graph checksum / artifact SHAs, and canonical object URLs.
Results carry description snippets, control names, validation objectives, evidence, incidents, vendors, and links — so an agent can act without a second round-trip.
One server, six tool groups.
Run from the apeiris-control-core repo root, then point an MCP client at the process:
npm run mcp # or: node adapters/apeiris-mcp/server.js
ATLAS — the MITRE ATLAS knowledge base
get_technique / get_mitigation / get_tactic / get_case_study | One pinned ATLAS object by id (type-checked), with description, links, tactic context. |
search | Full-text across all object kinds; results carry description snippets + urls. |
techniques_for_mitigation / mitigations_for_technique | Traverse the ATLAS mitigation graph both directions. |
version_diff / map_to_apeiris | What changed between two ATLAS releases · the Apeiris controls that address an ATLAS technique (name, objective, evidence, link). |
Graph — the Apeiris knowledge graph
get_node | One node by id, with label, type, canonical id, and the control's objective / evidence / links. |
neighbors / shortest_path / query_graph | Bounded adjacency, shortest provenance-carrying path, and typed traversal — mapping edges carry framework+relation. |
Corpus — evidence + obligations
evidence_for_control | What evidence a control needs and how each item is verified (automated / third-party / human / attested) + its objective and blocking effect. |
proof_for_obligation / obligations_for_framework | The proof chain + partial-coverage gap for an obligation · every obligation of a coverage framework with its verdict. |
search_controls | Full-text search across all 654 controls. |
implementation_profile_for_control / list_implementation_profiles | AP-128: a control's stack-conditioned implementation profile (per-step bindings, acceptance criteria, verification, anti-patterns as failure tests) · the controls carrying a profile (pilot layer). |
validation_test_for_control | CVT purple-team validation-test definitions + vendor-neutral detection suggestions for a control (ADR-0023). |
Knowledge — neighborhoods, incidents, vendors, provenance
neighborhood_for_control | The full knowledge-object view of a control: related controls, threats, real-world incidents, vendors, and its framework + evidence summary. |
incidents_for_control / controls_for_incident | Map controls ↔ AI Assurance Incident Briefs — with stage, why it applies, and the evidence to produce. |
vendors_for_control / vendors_for_capability / controls_for_vendor | Curated vendors/products that address a control or capability — and the reverse: every control a vendor's products address. |
source_info / describe_corpus / validate_corpus | Provenance + currency for a cited source · the corpus's controlled vocabularies, evidence ontology, and consumer invariants · a live integrity self-check (re-verify the manifest signature + artifact SHAs). |
Reasoning — the decision layer
These answer decision questions, not retrieval ones. Each is a deterministic composition of artifacts the corpus already computes each rehash — it is not an LLM engine, and it states coverage rather than asserting compliance (mapped ≠ satisfied).
explain_control | The full why chain for a control: the threats (ATLAS) it defends → the evidence it needs → the obligations it helps satisfy → real-world incidents → vendors → sources. ("Explain prompt injection from attack to regulation to implementation.") |
find_gaps | The weakest parts of assurance: the ranked opportunity map plus unsupported, single-source, and asserted-only (un-anchored) obligations, and thin threat coverage. |
minimal_control_set | The set-cover plan for a framework (marginal-coverage-ordered, from whatif.json) or the controls that defend a threat / attack class (threatcov.json). |
simulate_failure | What breaks if a control / vendor / source is removed: obligations that lose coverage (and which become unsupported), incidents left uncovered, vendors that become the sole path. |
what_changed | The corpus release history (optionally since a version). |
Research — the corpus-generated research layer (AP-77 REL)
Signed, reproducible research objects that reference canonical corpus objects by URI + hash — they never copy or mutate operational data. Every statistic re-derives byte-for-byte from a pinned corpus + manifest.
list_research_claims | The published research claims — each a statement supported_by reviewed evidence. |
get_research_statistic | A single research statistic: its value plus provenance (query, corpus version, manifest sha). |
explain_statistic | The full reproducibility trace for a statistic — how it re-derives byte-for-byte. |
get_research_query | A research query definition — the exact question a statistic answers. |
get_research_review | A claim's review: Cohen's κ / percent agreement + adjudication history. |
list_research_papers | The synthesized research papers (sections, figures, source-registry bibliography projection). |
get_research_finding | A synthesized finding — an interpretation supported_by a claim. |
get_research_paper | A full paper + its reproducibility package (pinned corpus / manifest sha + each figure's query hash). |
Worked round-trip (stdio JSON-RPC):
→ {"jsonrpc":"2.0","id":1,"method":"initialize"}
← {"jsonrpc":"2.0","id":1,"result":{"serverInfo":{"name":"apeiris-mcp","tools":42,
"manifest_signature":"ed25519-…","atlas_release":"v2026.06"}, ...}}
→ {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"neighborhood_for_control","arguments":{"control":"AA-02"}}}
← result.content[0].text =
{"id":"AA-02","domain":"agentic","incidents":[{"incident":"JADEPUFFER","stage":"credential_harvest", ...}],
"vendors":[...],"related_controls":[...],"frameworks":{"count":...},"provenance":{...}}
Full request/response for every tool: adapters/apeiris-mcp/README.md. Artifacts: atlas-model.json, graph.json (explore it in the Graph Explorer) — checksums in manifest.json. Consumers wanting only ATLAS can run the thin atlas-mcp hedge (npm run atlas:mcp).
Don't trust the server — pin the artifact.
The server refuses to serve if the manifest signature or any artifact hash doesn't verify. You can reproduce both checks yourself: recompute the artifact SHA-256 and verify the manifest's Ed25519 signature on the integrity page (with a self-contained, no-dependencies test vector). The builder docs cover the fetch → verify → use pattern; the API & endpoints page lists every JSON artifact.