compliance-agent

A Claude Code workspace for automated FedRAMP compliance auditing and Jira issue management for the ROSA Regional Platform.

Overview

This repo provides Claude Code slash commands and sub-agents that automate:

• FedRAMP High + Moderate compliance audits across ROSA Regional Platform repositories against NIST 800-53 Rev 5 controls
• Jira issue management for compliance findings and general ROSAENG work
• Architectural PR review documents written to Google Drive

Prerequisites

Environment Variables

Variable	Purpose
JIRA_MCP_TOKEN	Base64-encoded Basic auth token for the Jira MCP server (user@email.com:api-token encoded). Set in your shell profile.

The Jira MCP server reads JIRA_MCP_TOKEN via .mcp.json. Generate an API token at https://id.atlassian.com/manage-profile/security/api-tokens, then encode it:

echo -n "you@redhat.com:YOUR_API_TOKEN" | base64

Export the result:

export JIRA_MCP_TOKEN="<base64-string>"

Tools

Tool	Purpose
gh	GitHub CLI — used to clone repos and open PRs
trivy	CVE/misconfiguration scanning (auto-installed if absent)
mmdc	Mermaid CLI — renders diagrams in reports (npm install -g @mermaid-js/mermaid-cli)
md-to-pdf	Converts Markdown reports to PDF (npm install -g md-to-pdf)
rclone	Google Drive upload (must be configured with a gdrive remote)

Slash Commands

/fedramp-audit — FedRAMP Compliance Audit

Runs a full automated FedRAMP compliance audit across ROSA Regional Platform repositories. Produces written reports, PDFs, Jira tickets, and GitHub PRs in a single run.

/fedramp-audit [--moderate | --high | --both] [--repo <name-or-url>] [--epic <KEY>] [--cve | --no-cve | --cve-only] [--plan]

Flags

Flag	Default	Description
--moderate	—	Audit Moderate controls only
--high	—	Audit High-only delta controls only
--both	✓	Audit both baselines (default)
--repo <name>	all repos	Restrict to one repo; repeatable. Accepts short name or full GitHub URL.
--epic <KEY>	per-repo default	Link all Jira tickets to this epic (e.g. ROSAENG-264)
--cve	—	Enable Trivy CVE/secret/misconfiguration scanning; enriches SI-02, RA-05, SA-11
--no-cve	✓	Skip CVE scanning (default)
--cve-only	—	Run Trivy scan only; skip FedRAMP control analysis and GitHub PRs
--plan	—	Dry-run preview — no files written, no tickets created, no PRs opened

Target Repositories

Short Name	GitHub URL
rosa-regional-platform	https://github.com/openshift-online/rosa-regional-platform
rosa-regional-platform-api	https://github.com/openshift-online/rosa-regional-platform-api

Default Epic Associations

Repository	Default Epic
rosa-regional-platform	ROSAENG-264
rosa-regional-platform-api	ROSAENG-249

Common Invocations

# Full audit, both baselines, all repos
/fedramp-audit

# Preview what would be created — no side effects, safe to run anytime
/fedramp-audit --plan --epic ROSAENG-264

# Moderate only, single repo
/fedramp-audit --moderate --repo rosa-regional-platform

# Full audit with CVE scanning, linked to a specific epic
/fedramp-audit --both --cve --epic ROSAENG-264

# CVE scan only — no control analysis, no PRs
/fedramp-audit --cve-only

# CVE scan only for a single repo
/fedramp-audit --cve-only --repo rosa-regional-platform-api

Output

Artifact	Location
Per-repo Moderate reports (MD + PDF)	/tmp/fedramp-audit/reports/
Per-repo High-additional reports (MD + PDF)	/tmp/fedramp-audit/reports/
Moderate executive summary (MD + PDF)	/tmp/fedramp-audit/reports/
High-additional executive summary (MD + PDF)	/tmp/fedramp-audit/reports/
Jira tickets	ROSA project, redhat.atlassian.net
GitHub PRs	Target repositories (draft PRs; require human review)
CVE scan JSON (if --cve)	/tmp/fedramp-audit/<repo>-trivy-*.json

A full run across both repos and both baselines produces 12 files (6 MD + 6 PDF).

---

/jira.new — Create a ROSAENG Jira Issue

Creates a Jira issue in the ROSAENG project with the ROSA Regionality Platform component pre-filled. The command gathers acceptance criteria and context before confirming creation.

/jira.new <summary or description>

The command supports Stories, Bugs, Tasks, and Epics. It will:

1. Parse the provided summary/description
2. Ask for acceptance criteria, relevant file paths, and parent epic
3. Search for open epics to suggest a parent
4. Confirm the full issue before creating
5. Optionally link related issues and PRs

Examples:

/jira.new Add remote write configuration for RHOBS

/jira.new [Bug] Prometheus not scraping cross-namespace ServiceMonitors

---

/pr-review-doc — Architectural PR Review Document

Generates a formatted architectural review document in Google Drive for a GitHub PR, covering the problem statement, FedRAMP controls, proposed solution, and at least two alternate solutions with cost and overhead estimates.

/pr-review-doc --pr <PR_URL> --name <DOC_NAME> [--jira <JIRA_URL>] [--folder <DRIVE_FOLDER_URL>]

Flag	Required	Description
--pr <URL>	Yes	Full GitHub PR URL
--name <NAME>	Yes	Document name (used as Google Doc title)
--jira <URL>	No	Jira ticket URL for additional context
--folder <URL>	No	Google Drive folder URL. Defaults to the Design Discussions folder.

Examples:

/pr-review-doc --pr https://github.com/openshift-online/rosa-regional-platform/pull/388 --name ROSAENG-279

/pr-review-doc --pr https://github.com/openshift-online/rosa-regional-platform/pull/381 --jira https://redhat.atlassian.net/browse/ROSAENG-272 --name ROSAENG-272

---

Control Baselines

FedRAMP control definitions live in docs/ of this repository:

File	Controls
fedramp_moderate_controls.csv	~699 FedRAMP Moderate controls
fedramp_high_controls.csv	~801 FedRAMP High controls

The audit agent computes the High-only delta at runtime (controls in the High CSV not present in Moderate), ensuring no control appears in both reports.

MCP Configuration

.mcp.json configures the Jira MCP server and is excluded from version control. Create it locally:

{
  "mcpServers": {
    "jira": {
      "type": "http",
      "url": "https://mcp.atlassian.com/v1/mcp",
      "headers": {
        "Authorization": "Basic ${JIRA_MCP_TOKEN}"
      }
    }
  }
}

${JIRA_MCP_TOKEN} is expanded from the environment at runtime.