Metadata-Version: 2.5
Name: adlor-caiq
Version: 0.1.0
Summary: Open-source CLI for AI vendor risk assessment using CSA AI-CAIQ, NIST AI RMF, and ISO 42001
License-Expression: MIT
Requires-Python: >=3.12
Requires-Dist: pydantic>=2.10.0
Requires-Dist: pyyaml>=6.0.2
Provides-Extra: dev
Requires-Dist: pytest-asyncio>=0.24.0; extra == 'dev'
Requires-Dist: pytest>=8.3.0; extra == 'dev'
Provides-Extra: mcp
Requires-Dist: mcp>=1.2.0; extra == 'mcp'
Description-Content-Type: text/markdown

# [Adlor CAIQ] — AI Vendor Risk Assessment CLI & Schema

> **Open-Source AI Governance & Due Diligence Toolkit**  
> Aligned to **CSA AI-CAIQ v1.0**, **NIST AI RMF 1.0**, **ISO/IEC 42001:2023**, and **EU AI Act (2024/1689)**.

---

## 📌 Overview

`adlor-caiq` is a lightweight, zero-dependency CLI and schema evaluator that automates third-party AI vendor risk assessments. It provides an auditable 34-question structured framework across 6 core risk domains, generates executive markdown scorecards, detects critical compliance gaps, and provides remediation roadmaps before enterprise procurement.

### Key Capabilities
- 📋 **Standardized 34-Question Bank**: Mapped directly to CSA AI Controls Matrix, NIST AI RMF functions, ISO 42001 clauses, and EU AI Act articles.
- ⚖️ **Weighted Scoring Engine**: Domain-level and composite risk calculation (0–100) with risk tier classification (`LOW_RISK`, `MEDIUM_RISK`, `HIGH_RISK`, `CRITICAL_RISK`).
- 🔍 **Gap Analysis & Remediation**: Automatically flags missing, unanswered, or weak-evidence responses with actionable procurement recommendations.
- 📊 **Multi-Format Reporting**: Export reports in **Markdown** (Executive Scorecard), **JSON** (CI/CD integration), and **CSV** (Procurement spreadsheets).
- ⚖️ **Side-by-Side Vendor Comparison**: Benchmark two AI vendors head-to-head with delta scoring.
- ⚡ **Model Context Protocol (MCP)**: FastMCP server exposing scoring and question bank tools to Claude, Cursor, and Windsurf AI agents.

---

## 🚀 Quick Start

### Installation

```bash
pip install adlor-caiq
```

Or install with MCP server support:
```bash
pip install "adlor-caiq[mcp]"
```

---

## 🛠️ CLI Usage

### 1. Initialize a Blank Assessment Template
Generate a pre-filled `vendor-assessment.yaml` with all 34 questions and guidance notes:
```bash
adlor-caiq init -o my-vendor.yaml
```

### 2. Score a Completed Assessment
Evaluate the completed questionnaire and view domain-level risk scorecards in the terminal:
```bash
adlor-caiq score my-vendor.yaml
```

### 3. Export Formatted Reports
Generate an Executive Summary in Markdown, JSON, or CSV:
```bash
# Export Markdown scorecard
adlor-caiq export my-vendor.yaml --format md -o report.md

# Export JSON for automated CI/CD gating
adlor-caiq export my-vendor.yaml --format json -o report.json

# Export CSV for procurement teams
adlor-caiq export my-vendor.yaml --format csv -o gaps.csv
```

### 4. Benchmark Two Vendors
Compare two competing AI SaaS solutions:
```bash
adlor-caiq compare vendor-a.yaml vendor-b.yaml
```

---

## 🏛️ Assessment Domains & Framework Alignment

| Domain | Questions | CSA AI-CAIQ | NIST AI RMF | ISO 42001 | EU AI Act |
|---|---|---|---|---|---|
| **AI Governance & Accountability** | 6 | AIS-01 to 06 | GOVERN 1.1–4.1 | Clauses 5.2, 5.3, 6.1.2 | Articles 9, 14, 60 |
| **Data Provenance & Privacy** | 6 | DSP-01 to 06 | MAP 2.1–3.1 | Annex A.6, A.8, A.9 | Articles 10, 15 |
| **Model Transparency & Explainability** | 5 | AIE-01 to 05 | MAP 1.1–1.2, MEASURE 2.6 | Annex A.5, A.7 | Articles 11, 13, 53 |
| **Security & Adversarial Resilience** | 6 | SEC-01 to 06 | MEASURE 2.7–2.8 | Annex A.8.1–A.8.5 | Articles 12, 15 |
| **Operational Reliability & SLA** | 5 | OPS-01 to 05 | MANAGE 1.1–4.2 | Clauses 7.4, 8.1–8.3 | Articles 9, 12, 15 |
| **Regulatory Compliance & Ethics** | 6 | REG-01 to 06 | MAP 5.1, MEASURE 2.10 | Annex A.7.3, A.9.3 | Articles 10, 27, 50, 82 |

---

## 📄 License & Attribution

- **License**: MIT
- **Maintained by**: [Adlor Labs](https://adlor-lab-platform.vercel.app)
- **Primary Source Standard**: Cloud Security Alliance (CSA) AI Controls Matrix (AICM) & Consensus Assessment Initiative Questionnaire (AI-CAIQ).
