Parse OSCAL JSON today
Work with all eight OSCAL 1.2.2 models through the implemented JSON API.
The open-source toolkit for OSCAL
Parse, validate, and analyze machine-readable security and compliance data with Secani’s implemented TypeScript toolkit.
TypeScriptAPI preview
import { createOscalProcessor } from "@secani/oscal";
const processor = createOscalProcessor();
const bytes = new TextEncoder().encode(jsonSource);
const document = processor.parse(bytes, "json");
const result = processor.validate(document.json);
if (!result.ok) {
console.error(result.errors);
}One foundation for OSCAL workflows
Validate against official schemas
Run precompiled, eval-free JSON Schema validators without runtime dependencies.
Transform with typed APIs
Inspect and reshape structured control data in TypeScript.
Build interoperable tools
Create compliance workflows on open, portable data models.
For humans and for agents
Preview · Coming soon
pnpm add @secani/oscalFor agentsPreview · Coming soon
npx skills add secani/oscal-skillssecani/oscal-skills · Coming soon
A planned open-source collection of packaged instructions and optional scripts for agents working with OSCAL validation, conversion, catalogs, profiles, and related workflows.
Follow development on GitHubOSCAL tools, straight from the terminal
The planned open-source CLI will bring validation and conversion into local development and automated workflows.
What is OSCAL?
OSCAL stands for Open Security Controls Assessment Language. It is a NIST-led initiative, developed with industry and the public community, for representing security control information in machine-readable XML, JSON, and YAML.
NIST created the public project page in 2018 and published OSCAL 1.0.0, its first stable major release, in 2021.
OSCAL FAQ
OSCAL, the Open Security Controls Assessment Language, is a NIST-led initiative, developed with industry and the public community, for describing security controls, their implementation, and their assessment in machine-readable XML, JSON, and YAML. Its connected models let teams exchange compliance data between tools instead of locking it in proprietary documents.
Secani supports OSCAL 1.2.2 and all eight of its models: catalog, profile, component definition, system security plan, assessment plan, assessment results, plan of action and milestones, and mapping collection. Secani currently processes OSCAL JSON; XML and YAML are not supported yet.
Yes. In the Secani app you can import OSCAL JSON documents, validate them against the OSCAL schema, and export them again.
Frameworks in Secani’s framework library are OSCAL catalogs. You can browse them, get each one as an OSCAL file, and use Add framework to work with a catalog in your workspace.
Yes. The OSCAL Validator checks OSCAL 1.2.2 JSON for free and without an account. It runs entirely in your browser, so your document never leaves your device. For CI and other tools, the OSCAL Validation API validates the same documents over HTTP. Open the OSCAL Validator.
Not yet. The @secani/oscal TypeScript toolkit is implemented and being prepared for open-source release, but it is not yet published to npm. The oscal-cli command-line interface and the secani/oscal-skills collection for agents are planned.
Prepare for secani/oscal
Read the OSCAL concepts, review the implemented toolkit surface, and prepare your next interoperable compliance workflow. For automated checks, explore the OSCAL Validation API.