Norma

Turnkey CLASP-conformant gateway for Standards Developing Organizations. A single Next.js application that hosts ten publishers concurrently, each with a complete CoMP front-door, an MCP retrieval layer, a discoverability catalog, and a revocation list.

Norma is part of the Sèvres umbrella project; the implementation is MIT-licensed. The protocol it implements is CLASP, the Clause-Level Access and Standards Protocol.

On the name. Norma is Latin for a carpenter's square, the L-shape tool used to verify that two edges meet at a true right angle. The word also names a southern-hemisphere constellation of four faint stars in roughly that shape. The platform inherits the metaphor: an SDO plugs Norma in to check that its CLASP endpoints conform, the way a carpenter checks a joint against a square.

Each publisher's catalog lives under /<publisher>/.well-known/clasp-catalog in this demo; a real-world deployment would serve the catalog from the publisher's own root domain.

Fictional publishers

• Bioprocess and Pharmaceutical Equipment Council (bpec.example) — 1 standard
• US Food and Drug Administration (fda.gov) — 3 standards
• International Electronics Standards Federation (iesf.example) — 1 standard
• Internet Engineering Task Force (ietf.org) — 2 standards
• Modbus Organization (modbus.org) — 1 standard
• National Aeronautics and Space Administration (nasa.gov) — 1 standard
• National Institute of Standards and Technology (nist.gov) — 2 standards
• US Occupational Safety and Health Administration (osha.gov) — 1 standard
• Process Automation Standards Council (pasc.example) — 2 standards
• Technical Methods Federation (tmf.example) — 2 standards

Endpoints (per publisher)

• GET /<publisher>/.well-known/clasp-catalog — CatalogIndex
• GET /<publisher>/.well-known/clasp-catalog/<designation> — CatalogStandard
• GET /<publisher>/.well-known/clasp-revocations.json — revocation list
• POST /<publisher>/api/oauth/token — OAuth2 token issuance (HS256 JWT)
• POST /<publisher>/api/handshake — CoMP handshake
• POST /<publisher>/api/mcp — MCP JSON-RPC endpoint (Bearer required)

Status

Phase 2. All six CLASP tools (get_clause, search, resolve_term, list_changes, resolve_reference, compliance_check) are implemented against the loaded in-memory content. Tokens are HS256-signed JWTs; per-publisher revocation lists are served and consulted on every MCP call.