Andrii Bidochko

• Updated: July 16, 2026
• 7 min read

From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure

Direct Answer

The paper introduces a multi‑agent pipeline grounded in the Multi‑Component Prompting (MCP) paradigm that automatically transforms free‑form, legacy system descriptions into verified knowledge graphs and NIST OSCAL artifacts for continuous, threat‑informed compliance in critical infrastructure. This matters because it enables non‑invasive, real‑time compliance monitoring where traditional scanning is impossible, reducing manual audit effort while keeping risk assessments anchored to authoritative threat intelligence.

Background: Why This Problem Is Hard

Critical infrastructure—water treatment plants, power grids, and industrial control systems—relies on operational technology (OT) that often cannot be scanned with conventional vulnerability tools. The reasons are twofold:

• Safety and availability constraints: Active probing can disrupt physical processes, leading to downtime or safety incidents.
• Legacy documentation: System inventories are stored in free‑text manuals, spreadsheets, or outdated schematics that lack machine‑readable structure.

Existing compliance solutions typically assume a well‑structured asset database and direct network access. They either:

• Rely on periodic manual audits, which are costly and error‑prone.
• Use active scanning that produces incomplete coverage in OT environments.

Consequently, security teams face a blind spot: they cannot continuously map assets to the latest CVE or D3FEND knowledge bases, nor can they generate up‑to‑date OSCAL (Open Security Controls Assessment Language) documents required for NIST‑compliant reporting. The gap hampers both risk mitigation and regulatory adherence.

What the Researchers Propose

The authors present an MCP‑based multi‑agent pipeline that decouples large language model (LLM) reasoning from deterministic knowledge retrieval. The framework consists of three logical layers:

1. Natural‑Language Asset Extraction Agent: Parses unstructured system descriptions and emits a structured list of assets (e.g., device type, firmware version, operating system).
2. Knowledge Graph Builder & Verifier Agent: Takes the extracted entities, queries authoritative threat‑intelligence sources (CVE, D3FEND), and constructs a provenance‑rich graph that links assets to known vulnerabilities and defensive techniques.
3. OSCAL Artifact Generator Agent: Consumes the verified graph and produces NIST‑compliant System Security Plans (SSP) and Security Assessment Reports (SAR) in the OSCAL JSON/YAML format.

By grounding the LLM’s output against a deterministic retrieval step, the pipeline aims to eliminate hallucinated vulnerabilities while surfacing any extraction errors early in the workflow.

How It Works in Practice

Conceptual Workflow

The end‑to‑end process can be visualized as a four‑stage loop:

1. Input Ingestion: Operators upload legacy documentation (PDFs, text files, or scanned images) into the system.
2. Asset Extraction (MCP Prompt 1): An LLM, prompted with a carefully crafted schema, extracts entities such as “Siemens S7‑1500 PLC, firmware v4.2.1, Windows 10”. The MCP technique splits the prompt into component sub‑prompts that focus on entity type, version, and context, reducing ambiguity.
3. Verification & Graph Construction (MCP Prompt 2): For each entity, a deterministic retriever queries CVE databases and the D3FEND taxonomy. The results are merged into a knowledge graph where nodes represent assets and edges encode vulnerability or mitigation relationships, each annotated with source URLs and timestamps.
4. OSCAL Generation (MCP Prompt 3): The final agent traverses the graph, maps controls to NIST SP 800‑53 baselines, and emits a schema‑valid OSCAL SSP and SAR ready for downstream audit tools.

Interaction Between Components

Each agent runs in isolation but communicates through a shared message bus. The extraction agent publishes a JSON payload; the verifier subscribes, enriches it, and republishes the enriched payload. The OSCAL generator listens for the final enriched payload and triggers artifact creation. This decoupling enables:

• Parallel scaling of verification queries across multiple threat‑intel APIs.
• Plug‑and‑play replacement of the LLM (e.g., swapping a proprietary model for an open‑source one) without touching the deterministic layer.
• Auditable provenance logs that trace every CVE back to the original asset extraction decision.

What Makes This Approach Different

Traditional pipelines either:

• Push LLMs to directly generate compliance documents, risking hallucinations.
• Rely solely on static asset inventories, missing dynamic threat context.

By inserting a deterministic verification step between LLM reasoning and OSCAL generation, the proposed system shifts the error surface from “fabricated vulnerabilities” to “incorrect asset extraction”. This shift is intentional: a single mis‑extracted entity is easier for a human auditor to spot and correct than a fabricated CVE that appears plausible but has no grounding.

Evaluation & Results

Test Scenario: Synthetic Water Utility

The authors built a synthetic environment that mimics a municipal water treatment plant. The scenario includes:

• Twenty‑four distinct OT devices (PLC, SCADA servers, RTUs).
• Realistic version numbers and operating systems drawn from public datasets.
• Corresponding CVE entries and D3FEND defensive techniques curated from the latest NIST feeds.

Key Findings

• CVE Recall: The pipeline retrieved 90 % of the CVEs that truly apply to the assets, demonstrating that the verification step can capture the majority of relevant vulnerabilities despite noisy input.
• D3FEND Recall: The system achieved 100 % recall for defensive technique mapping, meaning every applicable mitigation was correctly identified.
• OSCAL Artifact Quality: Both the generated System Security Plan and Security Assessment Report passed NIST’s OSCAL schema validation tools without manual edits.
• Error Propagation Insight: In cases where the extraction agent mis‑identified a device model, the downstream verifier still produced a set of CVEs—albeit for the wrong asset—highlighting the pipeline’s transparent error path.

These results illustrate that the MCP‑based design can deliver high‑fidelity compliance artifacts while keeping the remaining errors tractable for human review.

Why This Matters for AI Systems and Agents

For AI practitioners building autonomous security agents, the paper offers three actionable takeaways:

1. Grounded Prompting Reduces Hallucinations: By separating reasoning (LLM) from factual retrieval, agents can maintain creativity without sacrificing factual correctness—a pattern applicable to any domain where regulatory compliance is mandatory.
2. Modular Agent Orchestration: The message‑bus architecture demonstrates a scalable way to chain heterogeneous agents (LLM, retriever, formatter) while preserving audit trails. This aligns with emerging standards for trustworthy AI pipelines.
3. Continuous Compliance as a Service: The ability to ingest legacy text and output up‑to‑date OSCAL documents opens a path for SaaS platforms to offer “compliance‑as‑code” for OT environments, reducing reliance on costly manual audits.

Enterprises looking to embed AI‑driven risk management can leverage the Enterprise AI platform by UBOS to host such multi‑agent workflows, integrate with existing SIEMs, and automate the delivery of OSCAL artifacts to auditors.

What Comes Next

While the pipeline marks a significant step forward, several limitations remain:

• Extraction Accuracy: The current MCP prompts still misinterpret ambiguous terminology in legacy manuals. Future work could incorporate domain‑specific ontologies or few‑shot examples to improve precision.
• Scalability of Verification: Querying multiple threat‑intel APIs for large asset inventories can hit rate limits. Caching strategies and federated knowledge graphs are promising avenues.
• Real‑World Deployment: The synthetic water‑utility scenario, while realistic, does not capture network segmentation, air‑gap constraints, or real‑time sensor data. Field trials in actual OT environments are needed to validate robustness.

Potential research directions include:

1. Integrating Chroma DB integration for vector‑based similarity search across historical compliance artifacts.
2. Extending the pipeline to generate actionable remediation playbooks, not just assessment reports.
3. Applying reinforcement learning to adapt MCP prompt structures based on downstream verification feedback.

Organizations interested in piloting this technology can explore the UBOS platform overview for a low‑code environment that supports multi‑agent orchestration, secure data handling, and compliance reporting.

References

For a complete technical description, see the original arXiv paper.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.