AVL Code
All cases
#011 · Compliance Check

Case study · Compliance Check

MLPS 2.0 Compliance Check Driven by a Baseline-Scanner MCP

You are a security-ops engineer who needs an MLPS 2.0 Level-3 baseline check on the Windows host at hand. In AVL Code, one natural-language instruction calls antiy-baseline-scanner-mcp; tool discovery, standard matching, the full scan and report archiving all run in one pass, and you end up with an interactive HTML compliance report containing 24 findings and remediation steps.

Target: a Windows 10 host (10.0.19045)· Standard: MLPS 2.0 Level 3 (S3A3G3)· Tool: antiy-baseline-scanner-mcp (v0.6.30)· Scale: 62 check items · 24 findings· Deliverable: interactive HTML compliance report · Model: Landi N2.5

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Wire up the service and take inventory — 3 tools and the standards list in hand

    You write the service name into the instruction and send it; AVL Code first lists which tools this MCP provides and which compliance standards are available.

  2. 02

    Match the standard — lock onto Windows MLPS Level 3, S3A3G3

    It reads the current host’s system information, confirms it is Windows, selects the baseline standard for the corresponding level on your behalf, and the scan starts right away.

  3. 03

    Full scan — 62 check items done, 24 findings surface

    A full check runs against the local host, yielding 38 pass / 24 fail, an overall compliance rate of 61.3%, and the per-domain distribution (existing data records the full scan finishing within 20 seconds, versus roughly 3–6 hours by hand).

  4. 04

    Archive the report — the interactive HTML lands in the project directory

    The report is copied from the scan tool’s output directory into avlcode/reports/; open it in a browser and you have a compliance report with dashboards, per-item commands and remediation steps.

Task for AVL Code

Use the antiy-baseline-scanner-mcp service to run a security compliance check for me, and generate the check report in HTML format

Prerequisites: The antiy-baseline-scanner-mcp service is already connected in AVL Code; the target is a Windows host that can run checks locally

Reproduction materials at the end of this article Try it yourself ↓

Tool and Standard Matching

The task’s entire input is a single sentence. The first thing AVL Code does is not scanning — it finds out what this MCP service has available:

You type → AVL Code 
Use the antiy-baseline-scanner-mcp service to run a security compliance check for me, and generate the check report in HTML format
AVL Code runs → you see
Lists the tools of antiy-baseline-scanner-mcp → confirms 3 tools in total
→ Lists the available compliance standards → fetches the host system information and confirms it is Windows
→ Selects the Windows security baseline standard (Level 3) and starts the compliance check
→ Scan completes, report generated in the output directory

Baseline Scan

The report is generated in the output directory, but the numbers have not entered your view yet. It reads the report first, then classifies:

You type → AVL Code 
Use the antiy-baseline-scanner-mcp service to run a security compliance check for me, and generate the check report in HTML format
AVL Code runs → you see
Reads the scan report → the first read is truncated → resumes from the truncation point to the end
→ Scan summary: 62 checks · 38 pass · 24 fail · compliance rate 61.3%
→ Finding grading: 8 high-risk · 16 medium-risk
→ Failure distribution: network security 11 · identity authentication 5 · access control 4 · security audit 3 · system maintenance 1

Archiving the Report

The numbers are read, but the report still sits in the scan tool’s output directory. It archives it per the project convention and organizes the conclusions for you:

You type → AVL Code 
Use the antiy-baseline-scanner-mcp service to run a security compliance check for me, and generate the check report in HTML format
AVL Code runs → you see
Copies the report into the project’s convention directory avlcode/reports/
→ Lists the remaining failed items one by one (medium-risk items such as remote registry access and submission control)
→ The 38 passed items cover: UAC enabled, blank-password restriction, SAM anonymous-enumeration restriction, Defender installed, etc.
→ Remediation path: fix the high-risk items first → work through the medium-risk items per the report’s steps → re-run the scan to verify

Try it yourself

The whole task needs only one message in the AVL Code session. Wire up the MCP service first, then send the instruction as-is:

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report 
Use the antiy-baseline-scanner-mcp service to run a security compliance check for me, and generate the check report in HTML format
  • Step 1: prerequisite — AVL Code is already connected to the baseline-check MCP service (antiy-baseline-scanner-mcp), which runs an MLPS Level-3 compliance check against <the target host>, with the report required in HTML format.
  • The session export does not preserve the raw MCP tool-call payloads (tool names, arguments and return JSON did not come through the export), so each step’s actions follow the assistant’s execution narration; "completed within 20 seconds" and "3–6 hours traditionally" come from the case’s existing data (the index.ts overview), and neither the session nor the delivered report contains timing fields; the itemized names of the 8 high-risk findings follow the delivered report.html.

Next question: After completing the remediation per the report’s steps, send the same instruction again for a re-check — subtracting the two reports’ compliance rates and failed-item lists item by item gives you direct evidence of the remediation effect.