Crosswalks are not certifications.
RuleOak distinguishes implemented/tested protocol behavior, security-framework mappings and hosted/external assurance.
MCP
The source recognizes documented modern MCP behavior on the surfaces it inspects/intercepts and retains compatibility handling for earlier supported deployments. This is not a claim to implement every MCP feature or interoperate with every client/server.
OpenSSF project security
The source tracks the OpenSSF OSPS Baseline Level-1 controls relevant to a fresh public repository. Hosted controls such as MFA, branch protection, secret scanning and private vulnerability reporting require live repository evidence after publication. The current OSPS Baseline version is v2026.08.28.
NIST SSDF
RuleOak maps secure-development/release practices to NIST SSDF concepts. NIST SP 800-218 v1.1 remains final; a v1.2 revision was published as an initial public draft in December 2025. RuleOak does not claim NIST certification.
OpenSSF Scorecard / SLSA / REUSE
Repository/release preparation includes immutable workflow pins, dependency/security review surfaces, SBOM/provenance preparation and SPDX/REUSE hygiene. A configuration file is not proof that the corresponding hosted control or attestation exists.