v1.1.1

Lists the MCP server in the Official MCP Registry as io.github.odedmoshe/policyseed. No change to the CLI, the templates or the rendered policies.

What's new

• npm package. policyseed is now on npm, so npx -y policyseed mcp runs the MCP server without going through GitHub. npx -y github:odedmoshe/policyseed mcp keeps working.
• Official MCP Registry. package.json has an mcpName field and the repository has a server.json, which the registry uses to check that the npm package belongs to this server.
• The bin path in package.json is written as bin/policyseed.js, the form npm expects, so publishing no longer prints an auto-correct warning.

v1.1.0

Adds policyseed evidence, a read-only collector for the audit evidence auditors ask for every period, saved as timestamped JSON with an index mapped to SOC 2 criteria.

What's new

• policyseed evidence runs read-only commands through the CLIs you already have installed and signed in (gh, aws, gcloud) and writes evidence/<date>/<criterion>-<collector>.json plus an INDEX.md that lists, per criterion, what each file shows and the auditor question it answers. 18 collectors cover GitHub (repository settings, branch protection and rulesets, Dependabot alerts, organization 2FA requirement, organization admins), AWS (account summary, credential report, password policy, CloudTrail, EBS default encryption, S3 encryption and public access block, RDS encryption and backups) and Google Cloud (project IAM policy, logging sinks, Cloud SQL backups, disk encryption, organizations).
• Commands run with execFile and fixed argument arrays, never through a shell. Secret-looking values are redacted before anything is written; --redact-account-ids shortens account IDs. A missing CLI, missing credentials or a denied permission is recorded as "not collected" with the reason and the run continues.
• --dry-run prints the exact commands, --list prints the collector table. The README lists the read-only permissions each provider needs, and docs/evidence.md has a scheduled workflow that collects the GitHub evidence monthly as a workflow artifact.

init, build, check, list and mcp still make no network calls. evidence calls only the cloud CLIs you run it with.

Limits

The files show configuration at the moment they were collected. They support, but do not replace, the auditor's own testing, and a collector that is "not collected" is a gap to close another way.

v1.0.0

First stable release. The CLI, the GitHub Action and the MCP server render the same 22 SOC 2 policy templates as https://policyseed.io, from one intake file, with no network calls and no dependencies.

What's in it

• CLI: policyseed init writes an intake.yaml, policyseed build renders the 22 policies into policies/, policyseed check exits 1 when a policy is overdue for review.
• GitHub Action (uses: odedmoshe/policyseed@v1): runs check (or build) in CI so an overdue policy review shows up as a red check. Inputs and outputs: docs/github-action.md.
• MCP server (policyseed mcp): lets Claude, Cursor or any MCP client interview you with the intake questions and render policies from the templates. Setup: docs/mcp.md.

Template changes since 0.2.0

• American spelling throughout.
• When MFA is not yet enforced for every account, the policies describe a dated rollout instead of stating MFA is in place.
• A new small_team context (headcount 1-10) gives incident response, business continuity and backup commitments a team without a staffed on-call rotation can meet, including a solo-responder path.
• Offboarding deadlines agree across the access, HR, acceptable use and physical security policies.
• Correct sentences when source control is "Other" or no CI/CD tool is named.

The full dated history is at https://policyseed.io/changelog.

Limits

These are templates, not legal advice and not an audit. Management adopts the policies and operates the controls; a CPA firm performs the SOC 2 examination. Review every policy before adopting it.

1.0.0

v0.2.0: MCP server (policyseed mcp) and a Marketplace-ready GitHub Ac…

v0.1.0 - 22 SOC 2 policy templates and the CLI

First public release of the Policyseed CLI and policy templates.

What is in here

• 22 SOC 2 governance policy templates (about 39,000 words), written to be adopted by a 10 to 50 person software company, not to sit in a folder.
• A deterministic renderer: answer 23 questions in intake.yaml and every policy comes out naming your actual identity provider, cloud, source control, MDM, password manager, logging and backup tooling. Conditional blocks drop the sections that do not apply to you.
• A CLI with no runtime dependencies:

npx github:odedmoshe/policyseed init    # writes intake.yaml
npx github:odedmoshe/policyseed build   # writes policies/01..22-*.md
npx github:odedmoshe/policyseed check   # exits non-zero when a policy review is overdue

• A GitHub Action example that fails CI when a policy's review date has passed, so policy review becomes a build failure instead of a calendar reminder nobody sees.

Scope and honesty

These are governance policy templates. They are not legal advice, they are not a compliance certification, and adopting them does not make a company SOC 2 compliant: management adopts the policies and an independent CPA firm performs the examination. Read every statement before you approve it; the documents describe how your company operates and they must be true.

Hosted version

https://policyseed.vercel.app renders the same 22 policies in the browser with no signup and nothing uploaded. The optional paid Audit Kit there adds AI tailoring, Word documents, a Trust Services Criteria crosswalk, an evidence checklist, acknowledgment forms and a review calendar.

Licence: Apache-2.0.