[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_116":117},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":26,"_34":-5,"_35":36,"_37":-5,"_38":-5,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":45,"_47":48,"_49":50,"_51":52,"_53":-5,"_54":45,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":-5,"_75":-5,"_76":45,"_77":-5,"_78":56,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88,"_89":90},"apiUrl","https://odel.app/api","creator","markac007","moduleId","mcp-server-scf","@markac007/mcp-server-scf","displayName","mcp server scf","tagline","MCP server for the SCF Controls Platform — 72 tools for controls, evidence, risk, and TPRM.","iconKey","https://avatars.githubusercontent.com/u/56160609?v=4","category","dev-tools","status","published","metaDescription","metaKeywords","deploymentType","external","workerName","bindingName","mcpConfig","pricingModel","free","creatorUserId","system:external-import","createdAt",1783312088000,"updatedAt","sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=app.scfcontrolsplatform%2Fmcp-server-scf","sourceVerified",false,"sourceMissingSince","importedAt","upstreamStars",0,"upstreamUpdatedAt",1782762296000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt","githubRepoUrl","https://github.com/MarkAC007/mcp-server-scf","githubRepoFullName","MarkAC007/mcp-server-scf","releaseId","ext-markac007-mcp-server-scf","version","1.6.3","descriptionMarkdown","

\n \n $\"SCF$ \n \n

\n\n# mcp-server-scf\n\n\n\n[![CI](https://github.com/MarkAC007/mcp-server-scf/actions/workflows/ci.yml/badge.svg)](https://github.com/MarkAC007/mcp-server-scf/actions/workflows/ci.yml)\n[![Security](https://github.com/MarkAC007/mcp-server-scf/actions/workflows/security.yml/badge.svg)](https://github.com/MarkAC007/mcp-server-scf/actions/workflows/security.yml)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/MarkAC007/mcp-server-scf/badge)](https://scorecard.dev/viewer/?uri=github.com/MarkAC007/mcp-server-scf)\n[![Socket.dev](https://socket.dev/api/badge/npm/package/mcp-server-scf)](https://socket.dev/npm/package/mcp-server-scf)\n\n\n\n[![npm version](https://img.shields.io/npm/v/mcp-server-scf.svg)](https://www.npmjs.com/package/mcp-server-scf)\n[![npm downloads](https://img.shields.io/npm/dm/mcp-server-scf)](https://www.npmjs.com/package/mcp-server-scf)\n[![install size](https://img.shields.io/packagephobia/install/mcp-server-scf)](https://packagephobia.com/result?p=mcp-server-scf)\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)\n[![MCP](https://img.shields.io/badge/MCP-compatible-green.svg)](https://modelcontextprotocol.io)\n\n\n\n[![MCP Registry](https://img.shields.io/badge/MCP_Registry-listed-green)](https://registry.modelcontextprotocol.io/v0/servers?search=scfcontrolsplatform)\n[![smithery badge](https://smithery.ai/badge/@MarkAC007/mcp-server-scf)](https://smithery.ai/server/@MarkAC007/mcp-server-scf)\n\n\n\n![TypeScript](https://img.shields.io/badge/TypeScript-6-blue?logo=typescript&logoColor=white)\n![Node.js](https://img.shields.io/badge/node-%3E%3D20-brightgreen?logo=node.js&logoColor=white)\n\n**Security compliance controls, frameworks, and risk management for AI agents.**\n\nGive your AI assistant access to 1,451 SCF security controls, 354+ framework mappings (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR), evidence tracking, risk registers, and vendor risk management — all through the [Model Context Protocol](https://modelcontextprotocol.io).\n\nBuilt for the **[SCF Controls Platform](https://scfcontrolsplatform.com/)**. Maintained by [ComplianceGenie.io](https://compliancegenie.io).\n\n> 🆕 **The platform is now open-source, self-hosted software.** The SCF Controls Platform — SCF-native GRC tooling for the free Secure Controls Framework content — is published under AGPL-3.0 at **[scf-controls-platform-oss](https://github.com/MarkAC007/scf-controls-platform-oss)**. Companies download and host it themselves via Docker Compose.\n\n> Having trouble? → [**docs/troubleshooting.md**](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/troubleshooting.md) · API key setup → [**docs/authentication.md**](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/authentication.md) · How it works → [**docs/architecture.md**](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/architecture.md)\n\n---\n\n## Overview\n\n`mcp-server-scf` connects AI assistants to the [SCF Controls Platform](https://scfcontrolsplatform.com/) via MCP, enabling natural language interaction with your compliance program. Your AI can browse the full SCF control catalog, track implementation progress, manage evidence collection, assess risks, and monitor third-party vendors — all without leaving your editor or chat.\n\n**74 tools** across 8 domains — click through for full parameter tables and example prompts:\n\n| Domain | Tools | Description |\n| ------------------------------------------------ | ----- | ---------------------------------------------------------------------------------------------------------------- |\n| [Catalog](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/catalog.md) | 6 | Browse 1,451 controls, 354+ frameworks, 5,736 assessment objectives |\n| [Control Scoping](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/scoped-controls.md) | 6 | Track implementation status across an 8-state workflow |\n| [Evidence](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/evidence.md) | 21 | Manage evidence collection, validation, maturity scoring, windowed AI assessments, and control-composite rollups |\n| [Risk Management](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/risk.md) | 12 | 5x5 risk matrix, risk register, custom risks and control mapping |\n| [Vendor Risk (TPRM)](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/vendors.md) | 7 | Vendor registry, AI-powered security research, DPSIA |\n| [Organization](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/organization.md) | 7 | Users, orgs, audit trail, work queue, notifications |\n| [Capabilities](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/capabilities.md) | 9 | KSI capability themes, scorecards, evidence posture, systems inventory |\n| [Webhooks](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/webhooks.md) | 6 | Webhook endpoints, delivery logs, secret rotation |\n\n---\n\n## Try it with MCP Inspector\n\nKick the tires without adding the server to a client — [MCP Inspector](https://github.com/modelcontextprotocol/inspector) launches a local UI that introspects every tool, its schema, and its description:\n\n```bash\nnpx @modelcontextprotocol/inspector npx -y mcp-server-scf\n```\n\nInspector opens on `http://localhost:6274` and connects to `mcp-server-scf` over stdio. You'll see all 74 tools, grouped by domain, with their Zod schemas rendered as a live form.\n\nLive tool calls need an API key — export `SCF_API_KEY` in the same shell before launching Inspector, or set it under the \"Environment Variables\" tab inside the Inspector UI. Without a key, you can still browse schemas and descriptions; tool calls return 401.\n\n---\n\n## Quick Start\n\n### 1. Self-host the platform & get an API key\n\nThe SCF Controls Platform is **open-source software you host yourself** — there is no sign-up. Deploy it from [scf-controls-platform-oss](https://github.com/MarkAC007/scf-controls-platform-oss) (a Docker Compose stack with bundled PostgreSQL, Redis, and MinIO), then:\n\n1. Set an `API_KEY` in the platform's `.env` (generate one with `openssl rand -hex 32`), or create a key in **Settings → API Keys** once the app is running.\n2. Note your instance's API URL — `http://localhost:8000` by default, or your deployed host.\n\nUse that key as `SCF_API_KEY` and the instance URL as `SCF_API_URL` (see [Configuration](#configuration)).\n\n### 2. Install — one-click\n\nPick the route for your client.\n\n**Claude Desktop** — the one-click path is the signed **[.mcpb Desktop Extension](#claude-desktop-extension-mcpb)** below. Claude Desktop does not register a custom URL scheme, so there is no clickable deeplink; instead you drag the `.mcpb` onto **Settings → Extensions** and paste your API key once. See [anthropics/claude-code#26952](https://github.com/anthropics/claude-code/issues/26952) for the upstream tracking issue.\n\n**Cursor** — click the badge below. Cursor registers the `cursor://` scheme, so the deeplink opens the IDE with the server config pre-filled:\n\n[![Install in Cursor](https://img.shields.io/badge/Install-Cursor-000000?logo=cursor&logoColor=white)](cursor://anysphere.cursor-deeplink/mcp/install?name=scf&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIm1jcC1zZXJ2ZXItc2NmIl0sImVudiI6eyJTQ0ZfQVBJX0tFWSI6InNjZl95b3VyX2FwaV9rZXlfaGVyZSIsIlNDRl9BUElfVVJMIjoiaHR0cHM6Ly91ay5zY2Zjb250cm9sc3BsYXRmb3JtLmFwcCJ9fQ%3D%3D)\n\n**Smithery** — managed hosted deployment:\n\n[![Try on Smithery](https://smithery.ai/badge/@MarkAC007/mcp-server-scf)](https://smithery.ai/server/@MarkAC007/mcp-server-scf)\n\nPrefer to edit config by hand, or on a client without a deeplink (Windsurf, Docker)? See **[3. Manual config](#3-manual-config)** below.\n\n### Claude Desktop Extension (.mcpb)\n\nFor Claude Desktop ≥ 0.11.0, the easiest install is a signed `.mcpb` bundle — no JSON editing, no `npx` runtime, no Node required on the host:\n\n1. Download `mcp-server-scf-.mcpb` from the [latest GitHub release](https://github.com/MarkAC007/mcp-server-scf/releases/latest).\n2. Double-click the file (or drag it onto Claude Desktop → **Settings → Extensions**).\n3. When prompted, paste your `scf_…` API key. It's stored in your OS keychain, not in a config file.\n4. Claude Desktop restarts the server and all 74 tools are available.\n\nTo uninstall or update the API key later: **Settings → Extensions → SCF Controls Platform → Configure**.\n\n### 3. Manual config\n\n**Claude Desktop** — edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n```json\n{\n \"mcpServers\": {\n \"scf\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"mcp-server-scf\"],\n \"env\": {\n \"SCF_API_KEY\": \"your_api_key_here\",\n \"SCF_API_URL\": \"http://localhost:8000\"\n }\n }\n }\n}\n```\n\n**Claude Code:**\n\n```bash\nclaude mcp add scf -- npx -y mcp-server-scf\nexport SCF_API_KEY=\"your_api_key_here\"\nexport SCF_API_URL=\"http://localhost:8000\"\n```\n\n**Cursor / Windsurf** — same JSON shape as Claude Desktop in `.cursor/mcp.json` (or the equivalent Windsurf path).\n\n**Docker:**\n\n```json\n{\n \"mcpServers\": {\n \"scf\": {\n \"command\": \"docker\",\n \"args\": [\"run\", \"-i\", \"--rm\", \"-e\", \"SCF_API_KEY\", \"markac007/mcp-server-scf\"],\n \"env\": { \"SCF_API_KEY\": \"scf_your_api_key_here\" }\n }\n }\n}\n```\n\n---\n\n## Configuration\n\n| Variable | Required | Default | Description |\n| ------------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------ |\n| `SCF_API_KEY` | Yes | — | API key from your self-hosted platform instance |\n| `SCF_API_URL` | Yes | — | Base URL of your self-hosted platform (e.g. `http://localhost:8000`). The former hosted default is decommissioned. |\n\n---\n\n## Example Prompts\n\nOnce connected, try asking your AI assistant:\n\n- \"What NIST 800-53 controls apply to access control?\"\n- \"Show me my organization's control implementation progress.\"\n- \"List all critical vendors and their risk scores.\"\n- \"Create a risk assessment for our cloud migration.\"\n- \"What evidence do I need to collect for SOC 2 audit?\"\n- \"Show the 5x5 risk matrix for my organization.\"\n- \"Run a DPSIA on our cloud provider vendor.\"\n\nMore examples live in each per-domain doc under [`docs/tools/`](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/).\n\n---\n\n## Documentation\n\n- [**docs/authentication.md**](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/authentication.md) — API key setup, rotation, region selection, scopes.\n- [**docs/architecture.md**](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/architecture.md) — request flow, error model, rate limiting, what the server does and does not do.\n- [**docs/troubleshooting.md**](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/troubleshooting.md) — symptom/cause/fix for the common failure modes.\n- [**docs/tools/**](https://github.com/MarkAC007/mcp-server-scf/blob/main/docs/tools/) — per-domain reference with full parameter tables.\n\n---\n\n## Security\n\n- API keys are never logged or included in error messages.\n- All communication uses HTTPS; keys are SHA-256 hashed server-side.\n- Rate limiting: 100 req/min read, 20 req/min write.\n- Multi-tenant — all operations scoped to your organization.\n- npm package published with [provenance attestation](https://docs.npmjs.com/generating-provenance-statements) via OIDC trusted publishing.\n- CI includes Gitleaks secret detection, CodeQL analysis, and Semgrep SAST.\n\nSee [SECURITY.md](https://github.com/MarkAC007/mcp-server-scf/blob/main/SECURITY.md) to report a vulnerability.\n\n---\n\n## Development\n\n```bash\ngit clone https://github.com/MarkAC007/mcp-server-scf.git\ncd mcp-server-scf\nnpm install\nnpm run build\nnpm run dev # Watch mode\nnpm run lint # ESLint\nnpm test # Vitest\n```\n\n### Testing with MCP Inspector\n\n```bash\nSCF_API_KEY=scf_your_key npx @modelcontextprotocol/inspector node build/index.js\n```\n\n---\n\n## Contributing\n\nContributions welcome! Please read [CONTRIBUTING.md](https://github.com/MarkAC007/mcp-server-scf/blob/main/CONTRIBUTING.md) before submitting PRs.\n\nThis project follows the [Contributor Covenant](https://www.contributor-covenant.org/) — see [CODE_OF_CONDUCT.md](https://github.com/MarkAC007/mcp-server-scf/blob/main/CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.\n\n1. Fork the repository\n2. Create your feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n---\n\n## License\n\nMIT — see [LICENSE](https://github.com/MarkAC007/mcp-server-scf/blob/main/LICENSE).\n\n---\n\n## Links\n\n- [scf-controls-platform-oss](https://github.com/MarkAC007/scf-controls-platform-oss) — the open-source, self-hosted platform (AGPL-3.0)\n- [ComplianceGenie.io](https://compliancegenie.io) — maintainer\n- [Model Context Protocol](https://modelcontextprotocol.io) — MCP specification\n- [SCF Framework](https://securecontrolsframework.com) — Secure Controls Framework\n- [npm Package](https://www.npmjs.com/package/mcp-server-scf) — npm registry\n- [Changelog](https://github.com/MarkAC007/mcp-server-scf/blob/main/CHANGELOG.md) — release history\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays","categoryDisplayName","Developer Tools","upstream",{"_93":94,"_95":96,"_97":98,"_99":100,"_101":102},"requiredSecrets",[],"tags",[],"assets",[],"stats",{"_91":56,"_92":56},"ratingAvg","reviewCount","topics",[103,104,105,106,107,108,109,110,111,112,113,114,115],"license","MIT","language","TypeScript","registryName","app.scfcontrolsplatform/mcp-server-scf","homepage","https://scfcontrolsplatform.com","ai-agent","claude","compliance","fedramp","grc","iso-27001","mcp","model-context-protocol","nist","risk-management","scf","security","soc-2","ENV",{"_118":119,"_120":121,"_122":123},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]