{"as_of":"2026-08-13T10:41:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:6d69078deb0f978aa05b2930fb98e58999dad088fe8e1338866fe91fb58017d8","coverage":[{"denominator":25,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":25,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-10T10:00:19.465944Z","state":"measured"},{"denominator":25,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":25,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-13T06:32:02.005865+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.08288/citation-record","integrity":"/paper/2607.08288/integrity","json":"/paper/2607.08288/citation-record.json","paper":"/paper/2607.08288"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.333382Z","title":"Disrupting the First Reported AI- Orchestrated Cyber Espionage Campaign","venue":null,"work_id":"5485078e-57ff-4c3c-84e8-8f4291f6535b","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:9b1dfc47f7654ca35e35db5c8e3c12fab7f3cf43d839c7446307680c5b98a1c5","observation_id":"df37b3eb-ce39-4be2-9471-8fc288a5d032","resolution":{"observed_at":"2026-07-10T10:07:01.334550Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.328484Z","title":"GPT-4.1 Model","venue":null,"work_id":"00d4227b-26a1-49cc-a3ce-4859af29b876","year":2026},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:485059a13e239da30db89f70c47607a169284fa1837436aefe93dc192dd579b5","observation_id":"26f0d3c0-3b9a-4009-84ea-e8c35fa92322","resolution":{"observed_at":"2026-07-10T10:07:01.329492Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2021.30957","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.008154Z","title":"A Survey of Cyber- Physical Attacks and Detection Methods in Smart Water Distribution Systems","venue":null,"work_id":"9b830c20-32ea-4c64-b4da-2140ef4fcdbb","year":2021},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:8f35063c2c602bf81e0f77468089d4df6b857e51e4c781a6afda061685e1cc7d","observation_id":"5c741c11-12c6-45fa-8a31-b6510f4eefe6","resolution":{"observed_at":"2026-07-10T10:07:01.009963Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.314554Z","title":"L333, pp","venue":null,"work_id":"3e309579-1b4d-4463-9d8a-054ba16bcf15","year":2022},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:fcaa723c4ddc1f5644040959aef0305c6693f4deee6230a35c96df99b239d930","observation_id":"fa7228e2-6d23-4f38-83f0-68f034ac62f9","resolution":{"observed_at":"2026-07-10T10:07:01.315735Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.331726Z","title":"Stand-der- Technik-Bibliothek","venue":null,"work_id":"e46a6f1b-b90a-4162-a551-e94774b065fc","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:4320ffc63be5d6baa48fab0d4da7485bae932d5e7e1bf92989fae9dc55ca8709","observation_id":"febf772b-be26-49e0-8ded-dba75a62b10f","resolution":{"observed_at":"2026-07-10T10:07:01.332849Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.330009Z","title":"Model Context Protocol","venue":null,"work_id":"da25cfa2-6260-4a24-b63e-ad56d86dfefc","year":2024},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:79b539863363e04c543e6b42006e7e3a1485ff1d6cb34ec9c3419b101c551ca2","observation_id":"b08a8005-4a62-41db-882d-066b98cb3b51","resolution":{"observed_at":"2026-07-10T10:07:01.331175Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.326675Z","title":"Towards the Automation of Attack Graph- Based Risk Assessment with OSCAL","venue":null,"work_id":"262d832d-6a47-456d-91c1-82a8bbca8a9e","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:466e12734efe76a453366411d9dc2f1cb225b5b2e9f2fe740647b32e08f55309","observation_id":"7b126e55-21a9-4bd1-bd22-509c52b7b299","resolution":{"observed_at":"2026-07-10T10:07:01.327943Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.23278","last_updated":"2025-10-07T07:13:32Z","snapshot_observed_at":"2026-08-13T06:47:33.344393Z","submitted_at":"2025-03-30T01:58:22Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","version":3},"cited_work":{"arxiv_id":"2503.23278","doi":"10.48550/arxiv.2503.23278","metadata_source":"pith","pith_arxiv_id":"2503.23278","snapshot_observed_at":"2026-07-11T02:47:49.588216Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","venue":"cs.CR","work_id":"3eff6b57-ab58-474f-afd9-4e115a5818a9","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"cited_paper":"/paper/2503.23278","citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:5675388f1df6f16fdfa02da1ab5d00e6a9854deaea8b31fa51c2bdf77f82fa76","observation_id":"8adcf2a2-d0b5-4e03-8462-013ca9224f09","resolution":{"observed_at":"2026-07-10T10:07:01.026230Z","resolver_source":"local_arxiv","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1186/s42162-026-00640-x","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Integrated Risk Scoring and Exploit Prediction for Cyber-Physical Power System Vul- nerabilities","venue":"Energy Informatics","work_id":"2f7acc2d-acc1-426d-a220-70c94690e0ab","year":2026},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:87e2d86aa8e58d38b6fe87e24ec3867971cfb24dfa013b4df836d2dfcdd6cddd","observation_id":"90a3c1ad-2af0-441e-b20b-d81fffadf249","resolution":{"observed_at":"2026-07-10T10:07:00.828901Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.323177Z","title":"CISA Stakeholder-Specific Vulnerability Categorization Guide","venue":null,"work_id":"673bf76d-0f20-4b6a-8968-bb91920bf083","year":2022},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:895aa92bd5ba6ea4f99de8ccf597333230ccbe9b1b5694d53c39e2de16e27983","observation_id":"8da4f9a9-5d24-4d60-8fb0-3347bdf67003","resolution":{"observed_at":"2026-07-10T10:07:01.324414Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.321464Z","title":"Common Vulnerability Scoring System Version 4.0: User Guide","venue":null,"work_id":"d3e6b946-491a-4223-97bc-2fc2378a2900","year":2023},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:a76871466054982113b776aba958e724bb1ff89c24617336a3973bfba59c3a0e","observation_id":"c339eb63-7de1-4fe0-b56e-47cfd307deb8","resolution":{"observed_at":"2026-07-10T10:07:01.322676Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1807.10357","last_updated":"2021-11-12T16:03:52Z","snapshot_observed_at":"2026-07-06T06:52:34.374453Z","submitted_at":"2018-07-26T20:44:16Z","title":"Towards an open standard for assessing the severity of robot security vulnerabilities, the Robot Vulnerability Scoring System (RVSS)","version":4},"cited_work":{"arxiv_id":"1807.10357","doi":"10.48550/arxiv.1807.10357","metadata_source":"pith","pith_arxiv_id":"1807.10357","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Towards an open standard for assessing the severity of robot security vulnerabilities, the Robot Vulnerability Scoring System (RVSS)","venue":"cs.RO","work_id":"e55fd0ef-48e2-4d78-9ca1-f64834c68708","year":2018},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"cited_paper":"/paper/1807.10357","citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:fbf16bfd5588f8d9e7e3796026d2d220656fbe286f6a3f73131d49d360aef1b5","observation_id":"be5f3483-8945-4a24-929a-ad2c900d4c9b","resolution":{"observed_at":"2026-07-10T10:07:00.818378Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2026.366576","doi":"10.1109/access.2026.3665768","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Vulnerability Management Chaining: An Integrated Framework for Efficient Cybersecurity Risk Prioritiza- tion","venue":"IEEE Access","work_id":"abbd2832-914b-4a78-906a-5734018b5fdc","year":2026},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:b05a9440f5ad07d49d955b16b0dab6bd6b971a387ba7a232b27a2ca4ce0748a4","observation_id":"29fe8337-bf3f-40f9-bdeb-a1c05e73ca34","resolution":{"observed_at":"2026-07-10T10:07:00.826747Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/s10207-024-00858-4","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Dynamic Vulnerability Severity Cal- culator for Industrial Control Systems","venue":"International Journal of Information Security","work_id":"567bc987-48e2-4bcf-a966-2f52f1758949","year":2024},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:329e08e02099f7ec8daeafd1d210827d82177c6ad26acbccd4e8fea8f87054dd","observation_id":"1156a84b-c9dc-4c82-837e-d50a2e668b1c","resolution":{"observed_at":"2026-07-10T10:07:00.823892Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.11070","last_updated":"2025-02-16T10:33:37Z","snapshot_observed_at":"2026-08-07T18:14:58.160611Z","submitted_at":"2025-02-16T10:33:37Z","title":"A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges","version":1},"cited_work":{"arxiv_id":"2502.11070","doi":null,"metadata_source":"pith","pith_arxiv_id":"2502.11070","snapshot_observed_at":"2026-07-10T10:07:01.022050Z","title":"A survey on vulnerability prioritization: Taxonomy, metrics, and research challenges.CoRR, abs/2502.11070","venue":"cs.CR","work_id":"b27c0375-046e-46ce-8f0d-46295964cdaf","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"cited_paper":"/paper/2502.11070","citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:71f0c18ca5d27ae80e18d97754543465073a261e88252ee429406932dbdb4465","observation_id":"bf364a0d-31b6-4248-be1c-0edb854a3b54","resolution":{"observed_at":"2026-07-10T10:07:01.023608Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/3436242","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Exploit Prediction Scoring System (EPSS)","venue":"Digital Threats Research and Practice","work_id":"bad13d25-7f75-4267-8a74-ce5790011e99","year":2021},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:a85647f4b6b7ba6d8839cbe6dee8fbfe475018c97a6aeef3041d193b3145d280","observation_id":"647ce3c4-4ed0-4a20-aa43-aa0fa1f23446","resolution":{"observed_at":"2026-07-10T10:07:00.817677Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-07-12T07:19:14.460149+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T07:19:14.460149+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.03767","last_updated":"2025-04-11T16:59:05Z","snapshot_observed_at":"2026-08-12T07:07:45.143945Z","submitted_at":"2025-04-02T21:46:02Z","title":"MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits","version":2},"cited_work":{"arxiv_id":"2504.03767","doi":"10.48550/arxiv.2504.03767","metadata_source":"pith","pith_arxiv_id":"2504.03767","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mcp safety audit: Llms with the model context protocol allow major security exploits","venue":"cs.CR","work_id":"d5c42cc2-8444-459f-bcc5-f36d34de7a47","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"cited_paper":"/paper/2504.03767","citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:d34b11535614a373042c568f54e77bb6da5ad37ffec9e275c51e4269ef885f5d","observation_id":"bb56844d-c1bf-4f55-8b45-0a7b549d0254","resolution":{"observed_at":"2026-07-10T10:07:00.827231Z","resolver_source":"local_arxiv","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.317889Z","title":"AgCyRAG: an Agentic Knowledge Graph based RAG Framework for Automated Secu- rity Analysis","venue":null,"work_id":"4f2c2605-b8bb-4491-8026-2d062f1cb2f2","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:fb902660f7befdc36ea2337707f65f421452cd428ddd1a2179c6ee6f27edf57e","observation_id":"ee385496-f361-4292-8678-624262320a64","resolution":{"observed_at":"2026-07-10T10:07:01.319095Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.23480","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.017055Z","title":"Agentic AI for Autonomous Defense in Software Supply Chain Secu- rity: Beyond Provenance to Vulnerability Mitigation","venue":null,"work_id":"b056e77b-6c49-4157-b4eb-f3d87c8359ed","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:bf716bd1777e8fbaa4e4cb03cdef88265772c9ffad04414ed23f967322452ae8","observation_id":"2362171a-444d-4a8e-bfdc-951d4346d8ee","resolution":{"observed_at":"2026-07-10T10:07:01.020853Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.08623","last_updated":"2025-05-02T18:26:39Z","snapshot_observed_at":"2026-08-07T16:06:28.979271Z","submitted_at":"2025-04-11T15:25:58Z","title":"Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies","version":2},"cited_work":{"arxiv_id":"2504.08623","doi":"10.48550/arxiv.2504.08623","metadata_source":"pith","pith_arxiv_id":"2504.08623","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Enterprise-grade security for the model context protocol (mcp): Frameworks and mitigation strategies","venue":"cs.CR","work_id":"80489713-f98e-4575-ab22-f0756c10a0b1","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"cited_paper":"/paper/2504.08623","citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:9ba50a73e6b370619f3de0effa080c589cd56cf3441eaeeeef69a0f313156626","observation_id":"37c7a9aa-96dd-4d1f-950b-8df909cebb0e","resolution":{"observed_at":"2026-07-10T10:07:01.012931Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.01333","last_updated":"2025-06-02T05:22:38Z","snapshot_observed_at":"2026-08-07T12:33:40.874784Z","submitted_at":"2025-06-02T05:22:38Z","title":"ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control","version":1},"cited_work":{"arxiv_id":"2506.01333","doi":"10.48550/arxiv.2506.01333","metadata_source":"pith","pith_arxiv_id":"2506.01333","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"ETDI: Mitigat- ing tool squatting and rug pull attacks in Model Context Protocol (MCP) by using OAuth-enhanced tool defini- tions and policy-based access control","venue":"cs.CR","work_id":"5f595e24-37c7-4729-869c-4529e6e0bf5f","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"cited_paper":"/paper/2506.01333","citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:a33f5e14000c05dd40b54d44ed98589da046ca998e3486202d9572a48a93db3b","observation_id":"f95f48ac-37b7-4c98-9eac-80bdac932ef6","resolution":{"observed_at":"2026-07-10T10:07:01.028882Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.316297Z","title":"Industrial Cybersecurity","venue":null,"work_id":"700e1ec7-9a72-4a78-905a-f4bf1c6cbf34","year":2024},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:e09c4a9d7bdf2eb57a4ac8e02703538f04c90fb2ad4056a86464f82f4db2cdd9","observation_id":"e362f7aa-c3ab-4325-bdd6-448acfe45ccd","resolution":{"observed_at":"2026-07-10T10:07:01.317373Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.13161","last_updated":"2025-06-16T07:17:34Z","snapshot_observed_at":"2026-08-07T00:33:35.599646Z","submitted_at":"2025-06-16T07:17:34Z","title":"Using LLMs for Security Advisory Investigations: How Far Are We?","version":1},"cited_work":{"arxiv_id":"2506.13161","doi":null,"metadata_source":"pith","pith_arxiv_id":"2506.13161","snapshot_observed_at":"2026-07-10T10:07:01.013997Z","title":"Using LLMs for Security Advisory Investigations: How Far Are We?","venue":"cs.CR","work_id":"65c6f326-9d19-42f6-a83a-000507ee9a1c","year":2025},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"cited_paper":"/paper/2506.13161","citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:05272c158593e42c9b9cb913be5f5265668b8a3f156844d05049e487f772a8e2","observation_id":"9ca6bb2c-5381-4667-8b8c-836317303042","resolution":{"observed_at":"2026-07-10T10:07:01.015449Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.319661Z","title":"Binding Operational Directive 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","venue":null,"work_id":"e84e51bf-b6a1-4804-b6d2-0d81221f7f8d","year":2021},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:4cc5950135b6e433021569a01071e604f3037b1eff496be575569513ee2ed9de","observation_id":"65d3bbbb-724f-4d8a-9810-e8586f127e2a","resolution":{"observed_at":"2026-07-10T10:07:01.320861Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T10:07:01.324956Z","title":"Guide to Industrial Control Systems (ICS) Security","venue":null,"work_id":"484cc0a2-3d42-4c3f-985d-9d94d6618325","year":2015},"citing_paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-10T10:00:19.465944Z"},"links":{"citing_paper":"/paper/2607.08288"},"observation_digest":"sha256:52a1673a667736fdffa4300032606444b937ea4479fcfc961e7a7ff2d276529e","observation_id":"4692d70e-0fea-4e64-9e1c-91f062d45c8a","resolution":{"observed_at":"2026-07-10T10:07:01.326063Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2607.08288","last_updated":"2026-07-09T09:32:03Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-06T13:22:34.232413Z","submitted_at":"2026-07-09T09:32:03Z","title":"From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure"},"reference_resolution":{"displayed":25,"state_counts":{"malformed_identifier":3,"metadata_mismatch":1,"parse_uncertain":0,"unresolved":0,"verified_exact":10,"verified_fuzzy":11},"total_outbound_references":25},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 25 of 25 outbound references and 0 inbound Pith citation observations for arXiv:2607.08288."}