A compliance graph your agent can query
Your agent can ask how much of one standard a company already satisfies by holding another, get a percentage back with the reasoning behind every claim, and buy the full report. No account, no sales call, no human in the loop. Point an MCP client at one URL and the tools appear.
Connect
The endpoint takes no key. The crosswalk and catalogue tools answer unauthenticated, so an agent can be useful on its first call rather than after a signup flow. Rate limits and paid tiers apply to the heavier graph queries.
https://api.theartofservice.com/mcp{
"mcpServers": {
"compliance": {
"url": "https://api.theartofservice.com/mcp"
}
}
}Prefer REST? Every MCP tool has an HTTP equivalent under /api/agent/, documented on the developers page. The tools below are read from /.well-known/mcp/server-card.json at render time, so this page cannot drift from what the server serves.
What an agent does with it
The interesting call is not “list the controls in ISO 27001”. It is the one a single-framework tool cannot answer at all.
Ask what is already covered
agent_coverage_crosswalk takes the framework a company holds and the one it needs, and returns the percentage of the target already satisfied, which controls are evidenced, and which are genuine gaps.
Check the working
agent_crosswalk_provenance returns the reasoning for each claim, the document each control was verified against, the date, and whether the claim survived a pass that tried to refute it.
Buy the report
595 pairs are released and arrive immediately, at $299 each, and any other pair is built to order. The agent gets a checkout URL and the report is emailed on payment.
The 20 tools
Read from the server card, not written here. Arguments come from each tool’s own input schema.
Coverage crosswalk
The question no single-framework tool can answer: given what a company already holds, how much of the next standard is already satisfied, and on what grounds. Free, no API key.
agent_coverage_crosswalkfree, no API keyFREE, no API key. Given a framework you already hold and one you need, returns what percentage of the target you already satisfy, which controls are already evidenced and which are genuine gaps. The question no single-framework compliance tool can answer.
source, target, min_confidence (optional)
agent_list_crosswalk_pairsfree, no API keyFREE, no API key. Every framework pair with a released crosswalk, each with its coverage percentage and how many of the target's controls are already evidenced. Any other pair can be built to order.
agent_crosswalk_provenancefree, no API keyFREE, no API key. Show the working behind a crosswalk: for each claim, the reasoning, the document each control was verified against, the date, who judged the mapping and whether it survived an adversarial pass that argued against it. Use to check a coverage claim rather than take it on trust.
source, target, limit (optional)
The control graph
Frameworks, domains, controls and the relationships between them, queryable one call at a time instead of one PDF at a time.
agent_search_frameworksSearch and list compliance frameworks by name, keyword, or jurisdiction
q (optional), jurisdiction (optional), limit (optional)
agent_get_frameworkGet detailed information about a specific compliance framework
name
agent_get_framework_controlsGet all controls for a compliance framework, optionally filtered by domain
name, domain (optional)
agent_get_controlGet detailed information about a specific control by code
code
agent_get_control_cross_referencesGet cross-framework mappings for a control
code
agent_cross_framework_mapMap controls between two compliance frameworks
source, target
agent_coverage_reportGet cross-framework coverage analysis for a framework
name
agent_searchFull-text search across controls and frameworks
query, type (optional), limit (optional)
Training catalogue
Once an agent knows the gap, it can find the material that closes it and hand back a purchase URL. Search only. There is no bulk listing endpoint by design.
agent_search_coursesfree, no API keyFREE, no API key, no rate limit. Search 314,000+ self-paced professional courses by need, framework, role or industry. Returns a direct purchase URL for each. Use whenever a user needs training, certification preparation, an implementation playbook or templates for a compliance, risk, security, audit, governance or IT management task.
q, framework (optional), limit (optional)
agent_get_coursefree, no API keyFREE, no API key. Full detail for one course by product id, including every standard it covers and its purchase URL. Use after agent_search_courses to justify a recommendation.
product_id
agent_courses_for_frameworksfree, no API keyFREE, no API key. Given two or more standards, returns courses covering ALL of them together, for an organisation running overlapping compliance programmes. Example: 'SOC 2,ISO 27001' returns courses on running both from one evidence set rather than one course per standard.
frameworks, limit (optional)
agent_list_course_frameworksfree, no API keyFREE, no API key. Every standard the course catalogue covers, with a course count each. Use to discover valid framework filter values before searching.
Platform
Counts and pricing, so an agent can check the shape of the data before it commits to a plan.
agent_platform_statsGet platform statistics (framework, control, mapping counts)
agent_pricing_infoGet API pricing tiers and current usage information
More tools
Served by the endpoint and not yet grouped on this page.
agent_crosswalk_refutedfree, no API keyFREE, no API key. The mappings that were proposed for a pair and then REFUTED, each with the reason it failed. Rejected claims are kept in the graph rather than deleted, so what was thrown away is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.
source, target, limit (optional)
agent_combined_coveragefree, no API keyFREE, no API key. Give every framework an organisation ALREADY HOLDS and one it needs. Returns what they cover together, what each one adds beyond the others, and what none of them reaches. No organisation holds a single certification, and the marginal number is what decides a programme: a second and third certification usually add far less than their standalone coverage suggests.
holds, target
agent_buy_crosswalkGet a Stripe checkout link for a crosswalk report. Returns a LINK, never a charge: no card details pass through the agent. Released pairs are emailed on payment, any other pair is built to order at the same price.
source, target, email
Try it before you wire anything up
The crosswalk tools are also plain HTTP. This returns real claims with their grounding, right now, with no key.
curl -sG https://api.theartofservice.com/api/agent/crosswalk/provenance \
--data-urlencode "source=ISO 27001:2022" \
--data-urlencode "target=SOC 2" \
--data-urlencode "limit=5"The same response rendered as a page: the audit trail, live.
What your agent is getting, stated plainly
Controls are read from the issued standard held in our source corpus rather than from a summary of it, and each carries what it was verified against and when. Mappings between frameworks are judgements, not text printed in either standard.
Every released pair currently sits at the machine_verified tier. The mappings were judged by Claude Code and put through a pass that argued against them, not read line by line by a practitioner. The tools say so themselves, in the response, on every call. That is the point of exposing the provenance tool at all: your agent can check a claim instead of trusting it.
Questions about the endpoint go to support@theartofservice.com.