OSCAL Workbench v0.1.0 (Windows preview)

OSCAL Workbench 0.1.0 Windows prerelease

OSCAL Workbench is a local Windows tool for turning structured security and compliance records into reviewable OSCAL documents. It supports rules-only conversion, optional reviewed Gemini or Azure OpenAI proposals, Snowflake snapshots, explicit evidence comparisons, repairable saved revisions, provenance, and JSON/YAML/XML or review-bundle export.

Download and run

Download OSCALWorkbench-0.1.0-windows-x64.zip from the GitHub Releases page, extract it, and run OSCALWorkbench\OSCALWorkbench.exe. Keep the complete portable folder together; the executable needs its bundled libraries and reference files. No separate Python or Node.js installation is required. Keep the app running while using its local browser interface. The prerelease is unsigned and is not an installer.

Try a first conversion

Start with the fictional templates/catalog.example.zip. In Convert files, choose Catalog and Rules only, upload the ZIP, enter a title such as Windows smoke catalog, choose Synthetic demonstration data under Source data classification, then choose Convert & validate. Review Issues, the artifact preview, and source references. Correct missing fields in the source or with Edit records, save the new revision, and export JSON, YAML, XML, or a review ZIP. The field guide defines exact headers and relationships; the templates guide explains blank and synthetic bundles.

What is included

The builder covers Catalog, Profile, Component Definition, System Security Plan, Assessment Plan, Assessment Results, Plan of Action & Milestones, and Control Mapping workflows. Rules mode remains local. AI transmission requires an explicit provider configuration, data policy, and consent; proposals require review before export. Snowflake access is bounded to metadata and selected-column snapshots using supported authentication methods. Monitoring schedules run only while the app is open.

The final source commit passed the Windows build and 97 source tests. The published ZIP also passed a fresh Windows runner smoke test, covering checksums, startup, Catalog conversion, JSON/YAML/XML exports, and repeatable ZIP output. The verification record includes the earlier packaged checks for all eight models.

This is a development preview. Broader Windows compatibility testing, code signing, live Gemini/Azure and Snowflake testing, accessibility and performance acceptance, and independent security review remain open. See supported features and limits and security boundaries before using real records.

Watch the walkthrough

Watch the 78-second narrated walkthrough with spoken narration generated locally with a Windows voice and on-screen captions, or read the written walkthrough.

Documentation clarification

The repository documentation now includes a plain-English disclaimer linking to the MIT License and explaining the need for independent checks and qualified human review before relying on or submitting generated results.