Paper deep dive
From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure
Lea Roxanne Muth, Marian Margraf
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 7/10/2026, 5:07:04 AM
Summary
This paper introduces a non-invasive, multi-agent pipeline that transforms unstructured natural-language system descriptions into structured, audit-ready NIST OSCAL artifacts for continuous compliance in critical infrastructure. By grounding LLM reasoning in deterministic threat intelligence via the Model Context Protocol (MCP), the framework minimizes hallucinations, constructs a verified knowledge graph, and applies a novel Critical Infrastructure Relevance Heuristic (CRH) for safety-first vulnerability prioritization. Evaluated on a synthetic water utility scenario, it achieves high CVE and D3FEND recall while shifting error propagation to a human-reviewable extraction phase.
Entities (10)
Relation Signals (10)
Multi-Agent System Pipeline → uses → Model Context Protocol (MCP)
confidence 97% · The pipeline uses 15 active MCP servers grouped into six functional categories.
Multi-Agent System Pipeline → generates → NIST OSCAL
confidence 96% · The resulting KG is converted into NIST OSCAL artifacts, specifically a System Security Plan and a Security Assessment Report.
Critical Infrastructure Relevance Heuristic (CRH) → combines → CVSS
confidence 95% · The heuristic combines CVSS, EPSS, and KEV with asset criticality and network exposure.
Critical Infrastructure Relevance Heuristic (CRH) → combines → EPSS
confidence 94% · The heuristic combines CVSS, EPSS, and KEV with asset criticality and network exposure.
Critical Infrastructure Relevance Heuristic (CRH) → combines → KEV
confidence 94% · The heuristic combines CVSS, EPSS, and KEV with asset criticality and network exposure.
ATT&CK → counteredby → D3FEND
confidence 94% · countered_by (ATT&CK to D3FEND)
CVE → linkedto → CWE
confidence 93% · Each pipeline phase appends nodes and edges incrementally... has_weakness (CVE to CWE)
CAPEC → mapsto → ATT&CK
confidence 93% · maps_to_technique (CAPEC to ATT&CK)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:In critical infrastructure, operational technology environments often cannot be actively scanned, and yet active system feedback is needed for risk assessment and compliance. This paper presents a non-invasive, MCP-grounded multi-agent pipeline that converts natural-language system descriptions into source-verified knowledge graph and audit-ready artifacts in the NIST OSCAL format for continuous automated compliance management. The architecture decouples LLM-based reasoning from deterministic knowledge retrieval against authoritative threat-intelligence sources, reducing the risk of fabricated vulnerabilities and hallucinated attack paths. In an evidence-based synthetic scenario of a water utility, the pipeline achieves 0.90 CVE recall and perfect D3FEND recall. It generates a schema-valid OSCAL System Security Plan and an OSCAL Security Assessment Report. Nevertheless, the core insight is not that grounding via MCP eliminates errors (e.g., hallucinations) entirely from the pipeline, but that it shifts errors into the first phase of asset extraction from the natural language description. Here, a single incorrectly extracted entity can lead to genuine but irrelevant CVEs in subsequent stages of the pipeline, which consumes time and resources. However, it makes the remaining risk visible, verifiable, and suitable for a time-efficient manual review, since the infrastructure (e.g., version numbers, OS, etc.) is typically known.
Tags
Links
- Source: https://arxiv.org/abs/2607.08288v1
- Canonical: https://arxiv.org/abs/2607.08288v1
Trouble viewing inline? Open PDF directly →
Full Text
48,790 characters extracted from source content.
Expand or collapse full text
From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure Lea Muth Marian Margraf Abstract In critical infrastructure, operational technology environments often cannot be actively scanned, and yet active system feedback is needed for risk assessment and compliance. This paper presents a non-invasive, MCP-grounded multi-agent pipeline that converts natural-language system descriptions into source-verified knowledge graph and audit-ready artifacts in the NIST OSCAL format for continuous automated compliance management. The architecture decouples LLM-based reasoning from deterministic knowledge retrieval against authoritative threat-intelligence sources, reducing the risk of fabricated vulnerabilities and hallucinated attack paths. In an evidence-based synthetic scenario of a water utility, the pipeline achieves 0.90 CVE recall and perfect D3FEND recall. It generates a schema-valid OSCAL System Security Plan and an OSCAL Security Assessment Report. Nevertheless, the core insight is not that grounding via MCP eliminates errors (e.g., hallucinations) entirely from the pipeline, but that it shifts errors into the first phase of asset extraction from the natural language description. Here, a single incorrectly extracted entity can lead to genuine but irrelevant CVEs in subsequent stages of the pipeline, which consumes time and resources. However, it makes the remaining risk visible, verifiable, and suitable for a time-efficient manual review, since the infrastructure (e.g., version numbers, OS, etc.) is typically known. †footnotetext: © 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. I Introduction In mid-September 2025, the global cybersecurity landscape underwent a significant tactical escalation. Anthropic’s Threat Intelligence team disclosed a sophisticated AI-orchestrated espionage campaign, presumably executed by the state-sponsored group GTG-1002 [1]. For the first time in documented history, threat actors leveraged an autonomous framework based on Anthropic’s Claude Code and the Model Context Protocol (MCP) to execute complex cyber operations with minimal human intervention (80%-90% automated tactical operations), demonstrating that the primary threat of AI lies not in generating novel zero-day exploits, but in accelerating the overall attack lifecycle [1]. This acceleration poses a severe systemic risk to critical infrastructure, where the defensive posture is often constrained by operational technology. critical infrastructure sectors such as energy and water management rely on legacy Industrial Control Systems (ICS) with life cycles that span decades. Given the fragility of these legacy operational technology environments, standard security measures (e.g., active vulnerability scanning) pose unacceptable availability risks [26]. Consequently, while attackers already use Multi-Agent Systems with MCP, defenders still lack real-time visibility and often rely on fragmented static asset documentation. While AI-powered tools promise to close this gap, they also introduce fundamental reliability problems, as they hallucinate Common Vulnerabilities and Exposures (CVE) identifiers, fabricate Common Vulnerability Scoring System (CVSS) scores, and generate plausible but fictitious attack paths [24]. In operational technology, hallucinated attack paths can trigger shutdowns leading to catastrophic scenarios. Without active scanning of the environment, defenders have no way of evaluating the statements made by AI tools. Another challenge is the gap in reliability, as regulatory bodies have tightened compliance requirements, e.g., through NIS-2 [4], which requires rigorous and well-documented risk management. In September 2025, the German Federal Office for Information Security (BSI) released the new Grundschutz++ requirements as machine-readable Open Security Controls Assessment Language (OSCAL) catalogs [5], creating the technical precondition for automated compliance. However, the mere availability of the JSON schema does not bridge this gap, as critical infrastructure operators possess unstructured, natural-language system descriptions (e.g., legacy documentation, operator-provided infrastructure summaries) and not the structured models required for automated AI reasoning. To address the above challenges, this paper proposes a non-invasive eight-phase pipeline utilizing a Multi-Agent System to transform natural-language system descriptions into audit-ready OSCAL security artifacts. To minimize hallucinations, the pipeline implements knowledge grounding through the MCP standard. Fifteen MCP servers integrate authoritative Cyber Threat Intelligence (CTI) sources into the agent inference process. Through the deterministic and LLM-assisted phases of the pipeline, agents iteratively enrich the Knowledge Graph (KG) with vulnerabilities, urgency ratings, attack paths, and complete taxonomy chains. The resulting KG is converted into NIST OSCAL artifacts, specifically a System Security Plan and a Security Assessment Report, enabling direct integration into audit workflows without requiring invasive active scans. Evaluated across five runs against a synthetic evidence-based hybrid IT and operational technology water utility scenario, the framework achieves a stable CVE Recall of 0.900.90, a D3FEND Recall of 1.001.00, and a Factual Hallucination Rate of 0%0\% for all deterministically sourced KG nodes. An entity extraction evaluation against manually verified ground truth reveals a Semantic Hallucination Rate of 12.5%, with the resulting Contextual False Positive Rate of 8.5% quantifying the error propagation from LLM-based entity extraction into the deterministic retrieval pipeline. The main contributions of this work are: • An MCP-grounded eight-phase pipeline for transforming unstructured critical infrastructure documentation into audit-ready OSCAL artifacts without active scanning, enabling direct integration into audit workflows, shifting failures from distributed LLM hallucination to a localized, human-reviewable control point (Phase 0). • An empirically grounded, domain-specific heuristic for vulnerability prioritization in operational technology that combines CVSS, EPSS, and KEV with asset criticality and network exposure for safety-first triage. I Background I-A The Model Context Protocol MCP is an open standard that provides a structured interface between LLM-based applications and external data sources or tools [6]. The pipeline uses 15 active MCP servers grouped into six functional categories as shown in Table I. TABLE I: Active MCP Servers by Pipeline Category Category Active Servers Reason Vuln. Foundations NVD, CPE, US-CERT, ICS-CERT, OpenCVE (5) CVE/CPE discovery and advisory enrichment Risk Filters KEV, EPSS (2) Exploitation evidence and probability scoring Infrastructure Visibility Shodan (1) Passive exposure reconnaissance Threat Taxonomies ATT&CK Enterprise, ATT&CK ICS, EMB3D, CAPEC, CWE (5) Attack pattern and weakness chaining Resilience & Defense D3FEND (1) Defensive counter- measure mapping Lifecycle & Supply Chain EOL (1) End-of-life and obsolescence detection In security assessment, MCP’s main advantage is constrained retrieval, as agents are prevented from hallucinating a CVE or a CVSS score, since they must execute pre-defined functions against validated endpoints. Furthermore, MCP ensures that responses are returned in structured JSON format rather than unstructured text, allowing schema validation before data ingestion into the KG. A fundamental limitation of traditional Retrieval-Augmented Generation (RAG) in cybersecurity is its reliance on vector similarity, which does not encode the strict causal and transitive logic required for risk analysis, as contrasted in Table I. Robust threat reasoning requires precise, verifiable links rather than semantic proximity alone. TABLE I: Traditional RAG vs. MCP Tool-Use in CTI Dimension RAG MCP Tool-Use Retrieval type Semantic similarity (vector search) Deterministic query (structured API call) Verification Probabilistic (cosine threshold) Binary (exists or does not) Error class Hallucinated associations Missing data (API gaps) Freshness Static corpus (re-indexing required) Real-time (live API queries) operational technology suitability Low (false positives trigger wrong decisions) High (verifiable ground truth) I-B Threat-Centric Metrics The Exploit Prediction Scoring System (EPSS) provides a probability (0−10-1) that a specific vulnerability will be exploited within the next 30 days [17], and the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog serves as a confirmation (binary) of active exploitation by threat actors [25]. This distinction is fundamental to the empirically calibrated heuristic proposed later in this paper, as the CVSS base score defines the potential impact of a vulnerability, while EPSS and KEV define the urgency of the threat. The heuristic combines these dimensions to isolate action-able threats from theoretical noise and ensure that limited defense resources are focused primarily on high-probability attack vectors. I-C The NIST OSCAL Framework The OSCAL was designed by NIST to standardize the exchange of security assessment data in machine-readable form including the following three artifacts. The System Security Plan (SSP) describes the target system’s boundaries, components, and the implementation status of required security controls. The Security Assessment Report (SAR) is a structured assessment report that links specific technical findings (e.g., CVEs, attack paths) back to the control requirements defined within the SSP, thereby identifying gaps between the required and the implemented controls. Although OSCAL defines a separate Security Assessment Plan (SAP), our framework encodes the plan directly from the deterministic pipeline configuration (selected MCP sources, assessment thresholds, and taxonomy traversal rules). These deterministic phases act as an implicit, reproducible SAP without any manual assessment plan creation required. I Related Work I-A MCP-Based Approaches in Security Research Prior work can be grouped into security analyses of MCP ecosystems and MCP-enabled security-agent architectures. Within the MCP ecosystem security literature, the authors of [8] provide an structured analysis of MCP attack surfaces across the server life cycle and develop a taxonomy of attacker types, threat scenarios, and corresponding safeguards. In [16], the authors add large-scale empirical evidence from 1,899 open-source MCP servers (343 official, 1,556 community), using static analysis plus an MCP-specific scanner. They report eight MCP-relevant vulnerability categories and quantify prevalence rates, including 7.2% general vulnerabilities, 5.5% tool-poisoning exposure, 66% code smells, and 14.4% traditional bug patterns. The authors of [18] demonstrate practical exploitation against mainstream LLMs through unmodified MCP servers and formalize the three attack classes of Malicious Code Execution, Remote Access Control abuse, and Credential Theft. They also released the agentic multi-stage auditing framework MCPSafetyScanner. Within the field of MCP-Enabled Security Agents, the authors of [19] propose AgCyRAG, a modular multi-agent cybersecurity RAG architecture with role-specialized agents for guardrailing, retrieval, SPARQL-based KG access, and answer refinement. Their SPARQL path uses MCP-mediated tool invocation over the SEPSES cybersecurity KG (CVE, CWE, CPE, CAPEC, ATT&CK). The authors of [20] combine LLM reasoning, reinforcement learning, and multi-agent coordination for CI/CD supply-chain security in a LangGraph stack, with MCP used as a communication layer for pipeline-integrated actions. In [21], the authors analyze enterprise MCP risks via a MAESTRO-based, multi-layer threat-modeling perspective and discuss deployment controls like stronger authentication and monitoring. Closely related hardening mechanisms such as immutable tool and version governance are developed in subsequent ETDI-oriented work [22]. To the best of our knowledge, no existing work combines MCP as a deterministic CTI interface layer, operational technology/critical infrastructure-specific KG construction with attack-path derivation, and OSCAL-validated audit-ready compliance artifacts. AgCyRAG [19] is architecturally closest but operates as a single-framework RAG system for retrospective analysis rather than proactive multi-phase threat modeling with epistemic guardrails. I-B Risk Prioritization in Operational Technology In operational technology and critical infrastructure environments, established vulnerability scores such as CVSS are only of limited use. Primarily as they are modeling IT impacts and effects, whereas in industrial systems, a single vulnerability can cause severe cascade effects. CVSS v3.1 is not reflecting this safety dimension in practice and although CVSS v4.0 introduces the Supplemental Safety value, it does not directly influence the base score [11]. Furthermore, its real-world applicability is currently limited because CVSS 4.0 assessments are only available for a fraction of all CVEs (as of March 2026). For reliable operational technology prioritization, a pure CVSS view is therefore not sufficient. Alternative frameworks address specific parts of the problem, but they do not replace an overall open, consistent operational technology score. CISA’s Stakeholder-Specific Vulnerability Categorization (SSVC) uses a decision tree rather than a numerical value to prioritize, taking factors such as mission impact, automation capabilities, safety impact, and exploitation status into account. In particular, the safety branch explicitly distinguishes between IT and operational technology consequences. The MITRE EMB3D is a valuable index for threat modeling of operational technology devices, but it is also not a universal prioritization index. Research further demonstrates the necessity for extensions of classical scores for cyber-physical contexts and multi-signal prioritization. The authors of [12] developed the Robot Vulnerability Scoring System (RVSS), which extends CVSS to include safety and physical impact aspects as well as cascade effects. It has been tested in practice but it is heavily robotics-centric. In their work [9] the authors combine multiple threat intelligence signals and show for ICS-relevant CVEs, that linking CVSS, EPSS, KEV, and operational technology characteristics improves prioritization, but with limited transparency and a high need for manual labeling. The authors of [13] validate the effectiveness of CVSS+EPSS+KEV in IT contexts, but do not include operational technology context factors. In [14], the authors demonstrate the advantages of environment-dependent adaptation using the Dynamic Vulnerability Severity Calculator, but do not integrate signals regarding the timeliness of threats. Generally, surveys such as [15] confirm the lack of an open context-sensitive operational technology standard. To counteract the aforementioned problem, we developed the critical infrastructure Relevance Heuristic (CRH), as it is designed as a transparent, numerical, and adjustable index. Methodologically, it adopts the safety-first logic from SSVC, the timeliness dimension from EPSS/KEV, the environmental adaptation approach from DVCC, and the empirically supported multi-signal combination from newer vulnerability management approaches. Unlike black-box machine learning models, the weighting and structure remain transparent and traceable, as CRH explicitly integrates the operational technology/critical infrastructure context (criticality of assets, network exposure/purdue segmentation) in contrast to IT-centric frameworks. The heuristics support automated, threshold-based triage without any loss of transparency. I-C OSCAL in Compliance-as-Code The authors of [7] demonstrate the integration of attack graphs into the NIST OSCAL ecosystem. Their framework validates the suitability of OSCAL as a pivot format for compliance automation and employs NIST SP 800-53 controls with DSL-based attack graphs for risk assessment. But the authors assume the existence of highly structured input data, specifically hardware and software bills of materials and formal DSL models in their work. In legacy operational technology environments, such structured artifacts rarely exist. Our approach addresses the gap between unstructured natural-language system descriptions and OSCAL, functioning as an automated ingestion layer for legacy environments. Furthermore, the authors aggregate temporal CVSS metrics via BFS traversal on DSL graphs. Our CRH heuristic combines CVSS with EPSS/KEV and operational technology-specific context factors (asset criticality, exposure) for active threat prioritization rather than static severity aggregation. For verification, they rely on the correlation between BOMs and vulnerability databases. Our approach enforces deterministic API calls against primary sources through MCP, with each KG node being verified individually, providing a verifiable ground truth over hallucinated vulnerability assignment. IV Theoretical Framework: Multi-Agent System Architecture and Experimental Setup IV-A Pipeline Phases The pipeline utilizes a graph-based Multi-Agent System to convert unstructured natural-language system descriptions into machine-readable compliance artifacts in OSCAL format. To adhere to the non-invasive operational constraints of operational technology infrastructures, the system operates strictly on passive input artifacts. As illustrated in Fig. 1, the transformation process is orchestrated through an eight-phase pipeline that incrementally enriches the central KG. The architecture enforces a strict separation between probabilistic LLM-driven phases (0, 0b, 3b, 5, 6) and deterministic phases (1, 2, 3a, 4). The KG is a directed graph with seven node types (Entity type, CVE, CWE, CAPEC, ATT&CK, and D3FEND) and connected by six typed edges: has_vulnerability (Entity to CVE), has_weakness (CVE to CWE), exploited_by (CWE to CAPEC), maps_to_technique (CAPEC to ATT&CK), exploits_technique (CVE to ATT&CK), and countered_by (ATT&CK to D3FEND). Each pipeline phase appends nodes and edges incrementally, so that after Phase 4 a fully expanded chain reads: Entity→ → → → &CK→ 3FEND. System descriptionShodan ReportPhase 0:Entity extraction+ SSP-GenerationBSI Grundschutz++ Catalogmcp-cpePhase 1:CVE-Discoverymcp-nvdmcp-cpemcp-cvemcp-ics-certmcp-CERTPhase 2:CRH-Scoringmcp-epssmcp-kevPhase 3a:TriagePhase 3b:CVE-RehabilitationPhase 4:Taxonomy Expansionmcp-cwemcp-capecmcp-attack-ent.mcp-attack-icsmcp-d3fendmcp-emb3dPhase 5:CVE Relevance ReviewPhase 6:Security AssessmentOSCALSystem Security PlanRisk-analysisOSCALSecurity Assessment ReportKnowledge Graphmcp-nvdmcp-eolAgent-PhaseDeterministicMCP-ServerExt. Catalog Figure 1: Architecture of the eight-phase pipeline: agent-supported phase (blue), deterministic phase (turquoise), MCP-backed data sources (green), BSI Grundschutz++ (yellow), and the central KG (pink). Output artifacts (red): OSCAL SSP, OSCAL SAR, and CRH-based Risk Assessment. IV-A1 Phase 0 - Entity Extraction & SSP Phase 0 initializes the KG by transforming a system description and a Shodan report into a structured asset inventory. The agent semantically decomposes the descriptions into hardware and software components, assigning each a vendor name, version number, topological role (Gateway/Pivot/Target), a type (PLC/HMI/Workstation/…), a criticality (critical/high/medium/low), and an exposure score (internet/DMZ/internal/isolated). The SSP is assembled from the previously extracted entities by serializing metadata, component definitions, CPE assignments, and BSI Grundschutz++ control implementation statements into a valid OSCAL JSON, which then serves as the baseline for the dynamic infrastructure KG and all subsequent pipeline phases. IV-A2 Phase 1 - CVE-Discovery Phase 1 uses a multi-stage discovery strategy. It begins by resolving CVE identifiers already present in extracted entities via mcp-nvd. Next, it performs CPE-based retrieval with normalized CPE strings (e.g., 9.2(4) → 9.2.4). To capture sector-specific findings that may not surface through plain CPE matching, it queries CISA ICS-CERT advisories by manufacturer names. Coverage is then expanded through alias CPE lookups for renamed products, followed by keyword- and concept-based fallback searches for entities without valid CPE matches, enabling the detection of vulnerabilities without standardized identifiers. All discovered CVEs are linked to their corresponding entities in the KG and annotated with strategy-specific confidence scores: 1.0 (CPE match), 0.9 (ICS-CERT match), 0.7 (keyword match), and 0.5 (fallback). IV-A3 Phase 2 - CRH-Scoring In Phase 2, all discovered CVEs are evaluated using the CRH. The CRH operates according to the principle of ”safety-first approximation” to resolve the systematic discrepancy between severity levels (CVSS) and operational operational technology risks. Mainly because in critical infrastructures an overlooked critical vulnerability (false negative) has far more devastating consequences than an irrelevant alarm (false positive). The parameters are therefore intentionally conservative in order to strictly prioritize recall over precision. The urgency index U is calculated additively according to (1), where U denotes the Urgency Index, SbaseS_base is the CVSS-derived severity base score, McontextM_context is the asset-context multiplier, and BthreatB_threat is an additive threat intelligence bonus. U=(Sbase×Mcontext)+BthreatU=(S_base× M_context)+B_threat (1) The components are defined as follows: Sbase=max(CVSS,5.0)S_base= (CVSS,5.0) (2) The CVSS base score in (2) is limited to a minimum of 5.05.0 by a Supervisory Control and Data Acquisition (SCADA) floor. This reflects the operational technology-specific character, as a CVE with a low CVSS score affecting a PLC carries far greater risk in critical infrastructure contexts than the score suggests, as physical processes are directly at stake. The threshold of 5.05.0 - the midpoint of the CVSS scale (0–10) - lifts low-rated operational technology vulnerabilities into the NVD ”Medium” category while preserving full scoring granularity above it. The context multiplier McontextM_context is composed of asset criticality CcritC_crit and exposure factor EexpE_exp: Mcontext=Ccrit×EexpM_context=C_crit× E_exp (3) The criticality levels CcritC_crit are inspired by the Purdue model [23], since it ranks operational technology assets according to their proximity to the physical process (Level 0-5), resulting in a criticality classification at the asset level. Critical (1.51.5) addresses assets at Level 0-1 (sensors, PLCs, RTUs, etc.), operational (1.251.25) corresponds to Level 2 (HMI, SCADA servers), and support (1.01.0) forms the baseline for Level 3+ (operation management, DMZ, enterprise IT). The exposure EexpE_exp distinguishes between Internal (1.01.0, accessible internally) and Internet-Exposed (1.51.5, visible through Shodan). The maximum single multiplier is limited to 1.51.5 in order to maintain CVSS granularity. A higher multiplier would place almost all critically exposed assets in the highest risk category, counteracting the differentiating purpose of the CVSS baseline value. Bthreat=EPSS×5+5if CVE∈KEV0elseB_threat=EPSS× 5+ cases5&if CVE \\ 0&else cases (4) The additive threat bonus BthreatB_threat from (4) is limited to the range [0,10][0,10], which means that active CTI can significantly influence the triage decision, but cannot determine it alone. Hence, a critical rating always requires a high CVSS base score and/or high context multiplier (critical asset, exposed). Therefore, BthreatB_threat sums the scaled EPSS probability (EPSS×5EPSS× 5) and a binary penalty for KEV entries (+5+5 points). This penalty ensures that KEV-listed CVEs are always significantly elevated regardless of their EPSS value. The symmetric weighting of both terms reflects two fundamental yet orthogonal sources of information. An asymmetrical distribution would inevitably result in one term dominating the other. The additive calculation of BthreatB_threat, in contrast to the multiplication used in classic risk models (e.g., risk=threat∗vulnerability∗impactrisk=threat*vulnerability*impact), prevents the methodological error of Score Masking. The additive integration guarantees that the potential for physical damage remains visible, regardless of the current statistical exploit probability. The Urgency Index is limited to an absolute maximum value (U≤32.5U≤ 32.5) and classified into four Urgency Categories (Critical ≥22≥ 22, High ≥14≥ 14, Medium ≥7≥ 7, Low <7<7). It should be emphasized that the selected constants are not universally optimal but empirically derived values. In the absence of an established gold standard for context-aware operational technology vulnerability prioritization, they serve as a transparent approximation with parameters that are disclosed to enable domain experts to customize them for specific systems. IV-A4 Phase 3 - Triage & Rehabilitation Phase 3 has two stages. In Phase 3a, CVEs are triaged if they satisfy any of three criteria: an absolute threshold (U>12U>12), a role-based threshold for gateway/target assets (U>5U>5), or KEV inclusion (unconditional override). High-urgency CVEs are then used to build attack paths across taxonomy chains (gateway → pivot → target), while all others move to Phase 3b. In agent-based Phase 3b, discarded CVEs are re-evaluated against the SSP component inventory (CPEs, vendors, asset types) using enriched CVE metadata and MCP-provided affected-products data for CPE-to-CPE matching instead of text heuristics. CVEs linked to expired end-of-life (EOL) assets are always rehabilitated, as there is no vendor fix, only workarounds or replacement. IV-A5 Phase 4 - Taxonomy Expansion The top 25 high-urgency CVEs are expanded along complete taxonomy chain. Each chain node is inserted into the KG and linked using typed edges. A maximum of 20 taxonomy chains are retained per CVE. For operational technology assets, ICS-specific ATT&CK techniques are prioritized and mapped to threats for embedded devices using mcp-emb3d. IV-A6 Phase 5 - Relevance Review In Phase 5, the agent analyzes the remaining CVEs for additional relevance and retroactively classifies a maximum of 5 additional CVEs as relevant, for which a taxonomy backfill (repeat Phase 4) is then performed. IV-A7 Phase 6 - Security Assessment In Phase 6, the SAR is generated based on the enriched KG, the relevant CVEs, and the constructed attack paths. The taxonomy chains are extracted by traversing the KG and incorporated as evidence in each CVE observation. In addition, the CRH, the EOL status, and the affected SSP component are included in the observations. The EOL context enables the agent to explicitly highlight affected assets without an available patch path as a strategic risk in the report. Both SSP and SAR are then validated against the NIST OSCAL JSON schemas. By passing the strict schema validation without errors, the artifacts confirm audit-readiness for direct integration into existing audit workflows. Altogether, the pipeline produces five output artifacts: OSCAL SSP, OSCAL SAR, CRH-based Risk Assessment (JSON), KG (JSON), and BSI-Grundschutz++ Gap-Analysis Report (JSON). IV-B Dataset - Evidence-Based Reference Architecture The reference scenario WaterWork represents a regional water facility with high-pressure pumps, chlorine dosing, and SCADA control. The architecture is modeled after documented patterns from real incidents [3]. The architecture includes a Cisco ASA 5505 (Firmware v9.2.4) as an internet-exposed VPN gateway without multi-factor authentication, an engineering workstation running Windows 7 SP1 with Advantech WebAccess/SCADA v8.2, a historian server based on Microsoft SQL Server 2012 Express (Windows Server 2012 R2), and six Siemens SIMATIC S7-1200 CPUs (Firmware v4.0) communicating through S7Comm on port 102 directly from the SCADA workstation. A vendor laptop from WaterTech Solutions with TeamViewer 11 is permanently connected to the network. There is no firewall segmentation between IT and operational technology zones (flat network on 10.10.10.0/24). The pipeline input consists of a Shodan report that exposes a single public IP with two services (TCP/443 AnyConnect, UDP/500 ISAKMP), the Cisco ASA CPE string, and CVE-2018-0101. Since the evaluation operates without live infrastructure, Shodan reports are provided as textual input to the pipeline. In a production deployment, the data stream would be obtained via the MCP-Shodan interface. In order to allow for a quantitative evaluation, we created a manually verified ground truth for the WaterWork scenario by listing the entire CVE surface area for each component through cross-referencing NVD CPE match criteria, vendor advisories, and ICS-CERT publications, yielding 292 CVEs across eight assets. Each CVE is assigned a validity rating for the respective version, a CVSS base score, and the current EPSS probability. The verified CVE set consists of 15 multi-stage causal attack paths that link perimeter breaches, lateral movements, and operational technology impacts, using only CVEs that have been confirmed for the versions used. Additionally, the ground truth includes 16 ATT&CK Enterprise technique mappings and 34 D3FEND countermeasure mappings with defense strategies for each attack path. This ground truth serves as a reference basis for measuring pipeline recall, triage decision accuracy, and actual hallucination rate. IV-C Evaluation Design The WaterWork scenario was assessed with the eight-phase pipeline. OpenAI GPT-4.1 [2] served as the base LLM. The deterministic phases (1, 2, 3a, 4) could access authoritative data sources through 15 active MCP servers, as illustrated in Table I. The scenario was executed in five independent runs with identical input to quantify the variance of the agent-based phases, and the pipeline outputs are evaluated against the ground truth. V Results & Discussion Across five independent runs, the pipeline consistently identified 8 entities and discovered 398±9398± 9 CVEs. For each node type in the KG, we verify its existence against the authoritative source. The hallucination rate is the fraction of nodes that fail this check. All CVE nodes in the KG (380±9380± 9 per run) correspond to valid NVD entries. As expected, the Factual Hallucination Rate for all KG nodes is 0%, meaning that no hallucinated identifiers were observed. While the deterministic MCP architecture guarantees a Factual Hallucination Rate of 0% (i.e., no fictitious CVEs or synthetic CVSS scores are generated), the pipeline remains susceptible to Contextual Hallucinations originating from Phase 0. If the LLM incorrectly extracts an asset from the unstructured text (e.g., a generic ”Windows” entity when only Windows 7 SP1 and Windows Server 2012 R2 are described), the deterministic retrieval logically propagates this error, retrieving valid CVEs for an absent asset. We define the Semantic Hallucination Rate in (5) where entity classifications are determined against the ground truth. SHR=FPentities/(TPentities+FPentities)SHR=FP_entities/(TP_entities+FP_entities) (5) Precision and Recall are defined as: Recall =TP/(TP+FN) =TP\,/\,(TP+FN) (6) Precision =TP/(TP+FP) =TP\,/\,(TP+FP) (7) Across all five runs, Phase 0 achieved an Entity Extraction Precision of 87.5% and a Recall of 100%, with an Semantic Hallucination Rate of 12.5% (1 FP entity, and 7/8 correct entities per run). Version extraction accuracy is 100% (7/7 correct across all runs). The single FP entity (”Windows (unknown version)”) was assigned the broadest possible CPE, causing the deterministic Phase 1 to retrieve 55 CVEs, of which 50 are unique to this entity. Of these 50 unique CVEs, 30 survive triage and appear in the final SAR, yielding a Contextual False Positive Rate of 8.5±0.2%8.5± 0.2\% (30 out of 350±9350± 9 SAR CVEs). The 30 Contextual False Positives are real CVEs for a non-existent generic Windows asset that pass the noise filter. Traditional RAG often fails at generation time by fabricating identifiers or scores. MCP-bounded retrieval removes that failure mode, but it introduces a different one, as a single semantic error in Phase 0 can propagate deterministically and still contribute irrelevant CVEs to the final SAR. In contrast to RAG’s distributed stochastic errors, the hallucination range shifts upstream to entity extraction phase and its precision. This concentrates the error surface in one identifiable phase, making failures both higher-impact and easier to localize. Consequently, the reliability of the pipeline is bounded by the precision of Phase 0, rendering entity extraction the critical control point for system reliability. The five independent runs confirm that the deterministic phases produce identical outputs for identical inputs. Entity extraction (Phase 0) is extracting the same 8 entities in every run across all five runs. The CVE set stability is high, as the core intersection across all five runs comprises 352 CVEs and the union 397 CVEs, with a mean pairwise Jaccard of 0.95±0.050.95± 0.05. The variance is attributable exclusively to LLM phases, as Phase 3b (triage rehabilitation) invoked 2.2±1.62.2± 1.6 tool calls per run, while Phase 5 (LLM promotion) consistently invoked 0 tool calls, indicating no additional CVEs were promoted by the agent in this scenario. Against 292 ground truth CVEs, the pipeline achieves a CVE Recall of 0.900.90 and a Precision of 0.740.74 across five runs, with 263 of 292 ground truth-CVEs matched per run. Of the 29 consistently missed CVEs, 26 are Adobe Flash/Reader CVEs and Windows Server 2012 R2 font-rendering CVEs discovered via the broad Windows OS CPE. These are correctly filtered by Phase 5 as irrelevant to the operational technology deployment context. Only one genuine miss remains, CVE-2017-14016 (Advantech WebAccess), which was found neither through CPE search nor via ICS-CERT advisory search, indicating a coverage gap for older ICS advisories. Against the expanded ground truth of 15 ATT&CK techniques, the pipeline achieves a Recall of 0.940.94 and a Precision of 0.90±0.030.90± 0.03, matching 14 of 15 techniques per run. Taxonomy chain completeness is calculated as follows, where ci∈0,…,4c_i∈\0,…,4\ counts populated levels per CVE: C¯=1n∑ci C= 1nΣ c_i (8) The pipeline achieves a D3FEND Recall of 1.001.00 and a Precision of 0.88±0.010.88± 0.01, matching all 3434 ground truth countermeasures per run. The completeness of taxonomy chains reaches 0.160.16 vs. 2.802.80 in ground truth, because only the top-25 high-urgency CVEs undergo a full chain expansion. To illustrate the qualitative output beyond aggregate metrics, the KG traces a multi-stage path from the internet-exposed Cisco ASA 5505 (CVE-2016-6366, CWE-120 Buffer Overflow → CAPEC-100 → T1068 Exploitation for Privilege Escalation → D3-MBT Memory Boundary Tracking) through the unpatched Windows 7 SP1 workstation (CVE-2019-0708, BlueKeep) to the SQL Server historian (CVE-2020-0618, CWE-502 Deserialization of Untrusted Data → CAPEC-586 → T1059 Command and Scripting Interpreter → D3-CF Content Filtering), with each node verified against its authoritative source. The CRH prioritization is compared against SSVC, which encodes practitioner consensus on vulnerability prioritization [10]. For the 318 CVEs with CVSS v3.x vectors, Spearman rank correlation (a non-parametric measure of ranking agreement, where ρ=1ρ=1 indicates identical ordering) between CRH and SSVC is ρ=0.797ρ=0.797, exceeding the CVSS-SSVC baseline of ρ=0.677ρ=0.677. The improvement reflects the operational technology context factors (asset criticality, exposure) that CRH adds beyond raw CVSS. The near-agreement rate (exact or ±1± 1 ordinal class) is 97.5% (310/318). Since both metrics share CVSS, EPSS, and KEV as inputs, this concordance should be read as an indirect consistency check rather than independent validation. To ensure CRH robustness, a one-at-a-time sensitivity analysis varies each CRH parameter independently while holding others at baseline values. Four parameters are swept: SCADA floor SbaseS_base, exposure multiplier EexpE_exp, KEV penalty, and triage threshold U. For each, triage volume, class migrations, and ground truth retention are reported. The full Phase 3a triage logic applies three OR-rules: urgency above absolute threshold, CISA KEV listed, and urgency above role threshold >5>5 for Gateway/Target assets. All ground truth CVEs in the triage-relevant set are retained across all 14 configurations. The triage threshold is the dominant sensitivity parameter (triage volume range = 217-330 CVEs), while SCADA floor, exposure multiplier, and KEV penalty have zero effect on triage volume under the role-based safety rule. Notably, CVE-2019-10943 (Siemens S7-1200, urgency 11.2611.26) falls below the absolute threshold of 12.0012.00 but is retained via the role-based rule (Target asset, urgency >5.00>5.00), demonstrating that the multi-rule triage design provides structural robustness against parameter variation. For a safety-first heuristic in critical infrastructure environments, the relevant validation criterion is decision stability, as no critical CVE must be lost under moderate parameter variation. The 100% ground truth retention across all 14 configurations directly evidences this property. The role-based safety rule (Gateway/Target >5>5) creates a structural safety net that decouples triage outcomes from the choice of individual parameters, even when the absolute threshold varies by ±50± 50%; the role-based rule independently retains all CVEs affecting exposed or target assets. This multi-rule design renders the system robust by construction against moderate parameter variations, rather than requiring precise calibration of any single parameter. The OSCAL export (SSP and SAR) passes strict NIST OSCAL v1.1.2 JSON Schema validation without errors across all five runs, confirming both the structural correctness of the internal KG and audit-readiness for direct integration into, e.g., the Grundschutz++ automated continuous compliance workflow. VI Limitations & Future Work Due to the absence of publicly available critical infrastructure or OSCAL datasets, the evaluation relies on only a single synthetic evidence-based reference architecture, so cross-scenario variance remains unquantified. The CRH heuristic is transparent but still needs to be evaluated further, and the SSVC comparison should be read as indirect validation rather than as a substitute for a dedicated expert study. The pipeline also remains limited to software-vulnerability-centric attack paths and does not model threats such as credential theft, insider abuse, or social engineering. The Phase 0 entity extraction constitutes the single LLM-dependent trust boundary in the pipeline. As demonstrated by the 12.5% Semantic Hallucination Rate and resulting 8.5% Contextual False Positive Rate, errors at this boundary propagate deterministically through all downstream phases. A human-in-the-loop review after Phase 0 could interrupt this cascade. As legacy operational technology systems rarely change, an analyst reviewing the extracted entities before the deterministic pipeline begins would break the error cascade at its origin. Furthermore, the evaluation depends on the timeliness and coverage of curated and periodically updated CTI sources. Therefore, temporal publication lag in CTI data or gaps in advisory feeds can affect triage accuracy. An advantage of the pipeline is its suitability for continuous assessment. Due to the low cost per run, the pipeline can be operated iteratively on a continuous basis. This mitigates temporal gaps in CTI source coverage. Finally, the BSI Grundschutz++ [5] is currently a preview and is being incrementally expanded. The finalized version is expected by the end of 2026. Until then, the catalog has no formal certification status, and Grundschutz++-based assessments are informational only. However, as the pipeline fetches the latest version from the BSI GitHub repository at runtime [5], rerunning the pipeline mitigates this limitation. Future work should include additional evidence-based scenarios from energy, transport, and other critical infrastructure sectors to test cross-domain robustness, and a structured concordance study with operational technology practitioners to provide stronger external validation of the CRH heuristic. VII Conclusion This paper presented a proof-of-concept for an MCP-grounded eight-phase agent pipeline for converting unstructured critical infrastructure documentation into audit-ready OSCAL security artifacts without active scanning of/within the critical infrastructure. The main contribution is a deterministic bounded-trust architecture in which MCP retrieval prevents fabricated identifiers in the KG, while the evaluation shows that residual failure is dominated by upstream semantic imprecision rather than downstream fabrication. In the WaterWork reference scenario, the system achieves strong recall of vulnerabilities and defensive mappings, produces valid SSP and SAR artifacts, and exposes a clear remaining weakness in entity extraction. For high-stakes operational technology workflows, this is a useful trade-off, as the error surface becomes narrower, more observable, and easier to control. The next step is, therefore, not more downstream generation, but better trust-boundary management at the point where raw language becomes structured assets. References [1] Anthropic Threat Intelligence, “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign”, Anthropic News, Nov. 13, 2025. [Online]. Available: https://w.anthropic.com/news/disrupting-AI-espionage/. (Accessed: 2026-03-08) [2] OpenAI, “GPT-4.1 Model”, OpenAI API Documentation. [Online]. Available: https://platform.openai.com/docs/models/gpt-4.1. (Accessed: 2026-03-08) [3] H. H. Addeen, Y. Xiao, J. Li, and M. Guizani, “A Survey of Cyber-Physical Attacks and Detection Methods in Smart Water Distribution Systems”, IEEE Access, vol. 9, July 2021. Available: https://doi.org/10.1109/ACCESS.2021.3095713 [4] European Parliament and Council of the European Union, “Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)”, Official Journal of the European Union, vol. L333, p. 80–152, Dec. 2022. [5] Bundesamt für Sicherheit in der Informationstechnik (BSI), “Stand-der-Technik-Bibliothek”, GitHub, Sep. 2025. [Online]. Available: https://github.com/BSI-Bund/Stand-der-Technik-Bibliothek. (Accessed: 2026-03-08) [6] The Linux Foundation, “Model Context Protocol”, GitHub repository, 2024, Available: https://github.com/modelcontextprotocol. (Accessed: 2026-03-08) [7] I. Koufos, M. Christopoulou, G. Xilouris, M.-A. Kourtis, M. Souvalioti, and P. Trakadas, “Towards the Automation of Attack Graph-Based Risk Assessment with OSCAL”, Lecture Notes in Networks and Systems, p. 319–328, Mar. 2025. Available: https://doi.org/10.1007/978-3-031-76459-2_30 [8] X. Hou, Y. Zhao, S. Wang, and H. Wang, “Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions”, CoRR, abs/2503.23278, Mar. 2025. Available: https://doi.org/10.48550/arXiv.2503.23278 [9] F. Kausar, L. Batiste, A. Muallem, and S. Hussain, “Integrated Risk Scoring and Exploit Prediction for Cyber-Physical Power System Vulnerabilities”, Energy Informatics, Feb. 2026. Available: https://doi.org/10.1186/s42162-026-00640-x [10] “CISA Stakeholder-Specific Vulnerability Categorization Guide”, Cybersecurity and Infrastructure Security Agency, Nov. 2022. Available: https://w.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf [11] FIRST, “Common Vulnerability Scoring System Version 4.0: User Guide”, Document Version 1.2, Nov. 1, 2023. [Online]. Available: https://w.first.org/cvss/v4.0/user-guide. (Accessed: 2026-03-08) [12] V. M. Vilches et al., “Towards an open standard for assessing the severity of robot security vulnerabilities, the Robot Vulnerability Scoring System (RVSS)”, Pre-print, arXiv, Nov. 2021. Available: https://doi.org/10.48550/arXiv.1807.10357 [13] N. Shimizu, and M. Hashimoto, “Vulnerability Management Chaining: An Integrated Framework for Efficient Cybersecurity Risk Prioritization”, IEEE Access, vol. 14, p. 31407–31424, Feb. 2026. Available: https://doi.org/10.1109/ACCESS.2026.3665768 [14] P. Cheimonidis, and K. Rantos, “Dynamic Vulnerability Severity Calculator for Industrial Control Systems”, International Journal of Information Security, vol. 23, p. 2655–2676, 2024. Available: https://doi.org/10.1007/s10207-024-00858-4 [15] Y. Jiang, N. Oo, Q. Meng, H. W. Lim, and B. Sikdar, “A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges”, Pre-print, arXiv, Feb. 2025. Available: https://arxiv.org/abs/2502.11070 [16] M. M. Hasan, H. Li, E. Fallahzadeh, G. K. Rajbahadur, B. Adams, and A. E. Hassan, “Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers”, CoRR, abs/2506.13538, Jun. 2025. Available: https://doi.org/10.48550/arXiv.2506.13538 [17] J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, “Exploit Prediction Scoring System (EPSS)”, Digital Threats: Research and Practice, vol. 2, no. 3, p. 1–17, 2021. Available: https://dl.acm.org/doi/10.1145/3436242 [18] B. Radosevich and J. Halloran, “MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits”, CoRR, abs/2504.03767, Apr. 2025. Available: https://doi.org/10.48550/arXiv.2504.03767 [19] K. Kurniawan, R. Firdaus, E. Kiesling, and A. Ekelhart, “AgCyRAG: an Agentic Knowledge Graph based RAG Framework for Automated Security Analysis”, Workshop (RAGE-KG 2025 at ISWC 2025), vol. 4079, Nov. 2025. Available: https://ceur-ws.org/Vol-4079/paper11.pdf [20] T. A. Syed, M. R. Belgaum, S. Jan, A. A. Khan, and S. S. Alqahtani, “Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation”, Pre-print, arXiv, Dec. 2025. Available: https://arxiv.org/abs/2512.23480 [21] V. S. Narajala, and I. Habler, “Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies”, Pre-print, arXiv, Apr. 2025. Available: https://arxiv.org/abs/2504.08623 [22] M. Bhatt, V. S. Narajala, and I. Habler, “ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control”, Pre-print, arXiv, Jun. 2025. Available: https://arxiv.org/abs/2506.01333 [23] P. Ackerman, “Industrial Cybersecurity”, 2nd ed. Birmingham, UK: Packt Publishing, 2024. [24] B. F. Abdullah, Y. S. Nugroho, B. Reid, R. G. Kula, K. Shimari, and K. Matsumoto, “Using LLMs for Security Advisory Investigations: How Far Are We?”, Pre-print, arXiv, June 2025. Available: https://arxiv.org/abs/2506.13161v1 [25] Cybersecurity and Infrastructure Security Agency (CISA), “Binding Operational Directive 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities”, Nov. 2021. Available: https://w.cisa.gov/binding-operational-directive-22-01. (Accessed: 2026-03-08) [26] K. Stouffer, V. Pillitteri, S. Lightman, M. Abrams, and A. Hahn, “Guide to Industrial Control Systems (ICS) Security”, National Institute of Standards and Technology, NIST Special Publication 800-82 Rev. 2, 2015.