[Adlor CAIQ] — AI Vendor Risk Assessment CLI & Schema

Open-Source AI Governance & Due Diligence Toolkit
Aligned to CSA AI-CAIQ v1.0, NIST AI RMF 1.0, ISO/IEC 42001:2023, and EU AI Act (2024/1689).

📌 Overview

adlor-caiq is a lightweight, zero-dependency CLI and schema evaluator that automates third-party AI vendor risk assessments. It provides an auditable 34-question structured framework across 6 core risk domains, generates executive markdown scorecards, detects critical compliance gaps, and provides remediation roadmaps before enterprise procurement.

Key Capabilities

• 📋 Standardized 34-Question Bank: Mapped directly to CSA AI Controls Matrix, NIST AI RMF functions, ISO 42001 clauses, and EU AI Act articles.
• ⚖️ Weighted Scoring Engine: Domain-level and composite risk calculation (0–100) with risk tier classification (LOW_RISK, MEDIUM_RISK, HIGH_RISK, CRITICAL_RISK).
• 🔍 Gap Analysis & Remediation: Automatically flags missing, unanswered, or weak-evidence responses with actionable procurement recommendations.
• 📊 Multi-Format Reporting: Export reports in Markdown (Executive Scorecard), JSON (CI/CD integration), and CSV (Procurement spreadsheets).
• ⚖️ Side-by-Side Vendor Comparison: Benchmark two AI vendors head-to-head with delta scoring.
• ⚡ Model Context Protocol (MCP): FastMCP server exposing scoring and question bank tools to Claude, Cursor, and Windsurf AI agents.

🚀 Quick Start

Installation

pip install adlor-caiq

Or install with MCP server support:

pip install "adlor-caiq[mcp]"

🛠️ CLI Usage

1. Initialize a Blank Assessment Template

Generate a pre-filled vendor-assessment.yaml with all 34 questions and guidance notes:

adlor-caiq init -o my-vendor.yaml

2. Score a Completed Assessment

Evaluate the completed questionnaire and view domain-level risk scorecards in the terminal:

adlor-caiq score my-vendor.yaml

3. Export Formatted Reports

Generate an Executive Summary in Markdown, JSON, or CSV:

# Export Markdown scorecard
adlor-caiq export my-vendor.yaml --format md -o report.md

# Export JSON for automated CI/CD gating
adlor-caiq export my-vendor.yaml --format json -o report.json

# Export CSV for procurement teams
adlor-caiq export my-vendor.yaml --format csv -o gaps.csv

4. Benchmark Two Vendors

Compare two competing AI SaaS solutions:

adlor-caiq compare vendor-a.yaml vendor-b.yaml

🏛️ Assessment Domains & Framework Alignment

📄 License & Attribution

• License: MIT
• Maintained by: Adlor Labs
• Primary Source Standard: Cloud Security Alliance (CSA) AI Controls Matrix (AICM) & Consensus Assessment Initiative Questionnaire (AI-CAIQ).