FedRAMP Docs MCP Server

Disclaimer: This is an unofficial, community project and is not affiliated with, endorsed by, or associated with FedRAMP or the U.S. federal government. The author is not officially affiliated with FedRAMP. The FedRAMP name and any related marks are property of their respective owners.

Custom Model Context Protocol (MCP) server that makes the FedRAMP/docs repository queryable with FRMR-aware tooling. The server scans FRMR JSON datasets and supporting markdown guidance, exposes structured tools for analysis, and can optionally clone and cache the upstream repository for you.

Demo

See the FedRAMP Docs MCP Server in action with Claude Desktop:

https://github.com/user-attachments/assets/653c3956-0bfb-46c4-9e72-8a6d75e3a80d

Documentation

Additional resources:

• Local Development - Build from source

• Docker Setup - Container deployment

• Security Hardening - Production configurations

• Contributing - How to contribute

Prerequisites

• Node.js 18 or higher

• npm 8 or higher

Features

• Auto-detects all 12 FRMR JSON document types and builds typed metadata.

• Extracts KSI entries, flattened control mappings, and Significant Change references.

• Fast markdown search via an inverted index backed by Lunr with snippets and line numbers.

• Indexes 62+ markdown files from tools/site/content/ (Zensical static site content).

• Structured diffing between FRMR versions, including per-item change detection.

• Health check, version listing, and curated Significant Change guidance aggregator.

• Claude Plugin with slash commands, agent skills, and compliance analyst agent.

• Docker support with security hardening following 2025 best practices.

Supported Document Types

Getting Started

Local Development

1. Install dependencies:

2. Build the project:

3. Run the server:

Global Installation

To install globally and use the fedramp-docs-mcp command:

Note: Global installation is required if you want to use fedramp-docs-mcp as the command in MCP client configurations (Claude Desktop, Goose, etc.). Alternatively, you can use the full path to the built server: node /path/to/fedramp-docs-mcp/dist/index.js

CLI Commands

The package includes helpful CLI commands:

During startup the server ensures a FedRAMP/docs repository is available, indexes FRMR JSON and markdown content, then begins serving requests on MCP stdio.

Configuration

Environment variables control repository discovery and indexing behaviour:

Set FEDRAMP_DOCS_PATH if you maintain a local clone. Otherwise leave it unset and allow the server to create a shallow cached copy.

Keeping Data Up-to-Date

The server includes automatic update checking to keep the FedRAMP docs current:

Automatic Updates (Default Behavior):

• Every 24 hours (configurable), the server checks if the cached repository needs updating

• If updates are available, they're fetched automatically on server startup

• This ensures you always have recent FedRAMP data without manual intervention

Manual Updates:

• Use the update_repository tool to force an immediate update

• Example query in Claude Desktop: "Update the FedRAMP docs repository"

• Useful when you know new requirements or guidance has been published

Disabling Auto-Update:

Custom Update Frequency (check every 6 hours):

Available Tools

The server provides 20 tools organized into categories. All tools follow the error model and respond with JSON payloads.

Document Discovery

KSI (Key Security Indicators)

Control Mapping

Search & Lookup

Analysis

System

Evidence Collection Suggestions

The get_evidence_examples tool provides community-suggested evidence examples for each KSI. These are automation-friendly suggestions showing how to programmatically collect compliance evidence via APIs, CLI commands, and security tools.

Important: These are NOT official FedRAMP guidance. Always verify requirements with official FedRAMP documentation.

What's Included

For each of the 72 KSI indicators, we provide:

• Evidence types: API calls, reports, scans, logs, configurations, documentation

• Automation sources: AWS, Azure, GCP, Okta, Splunk, Terraform, GitHub Actions, etc.

• Example commands: Ready-to-use CLI commands and API endpoints

Example Evidence Sources by Theme

Usage Example

See src/tools/ for the precise schemas implemented with Zod. Each tool returns either a successful object or an error payload containing code, message, and optional hint.

Usage Examples

When using the MCP server with Claude Desktop or other MCP clients, here are some example queries:

Getting KSI Information:

Searching Documentation:

Working with Controls:

Analyzing Changes:

Advanced Queries: Dashboard & Architecture Insights

These prompts combine FedRAMP data with Claude's analytical capabilities to help you design compliance dashboards and features:

Dashboard Architecture:

Visualization Design:

Feature Planning:

Data Modeling:

Executive Reporting:

MCP Client Configuration

The FedRAMP Docs MCP server works with any MCP-compatible client. Below are setup instructions for the most popular and reliable clients.

Recommended clients:

• Claude Desktop - Most mature MCP integration, excellent tool discovery

• Claude Code CLI - Official Anthropic CLI tool, great for terminal workflows

• LM Studio - Native MCP support, works with local models for privacy

• OpenCode - Terminal-based coding agent with MCP support

• Goose - Experimental support, may have tool discovery issues

Claude Desktop

Add the server to your Claude Desktop configuration file:

Location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Option 1: Using npx (Recommended - no install required)

Option 2: Global installation

After updating the config, restart Claude Desktop. The FedRAMP Docs tools will appear in your conversations.

Claude Code CLI

Claude Code is Anthropic's official CLI tool with built-in MCP support.

Method 1: Using CLI (Recommended)

Method 2: Configuration File

Claude Code supports three configuration scopes:

1. Project-scoped (recommended for teams): .mcp.json in project root

2. User-scoped: ~/.claude/settings.local.json

3. Project-local: .claude/settings.local.json in project root

Example

With environment variable expansion:

Testing:

• Restart Claude Code after configuration changes

• Use /mcp command for interactive management

• Use --mcp-debug flag for troubleshooting: claude --mcp-debug

• Verify with: claude mcp list

Note: Project-scoped configurations in .mcp.json enable team collaboration by ensuring all team members have access to the same MCP tools.

LM Studio

LM Studio (v0.3.17+) has native MCP support and works great with local models for privacy-focused workflows.

Setup Instructions

1. Open LM Studio and click the Program tab (terminal icon >_) in the right sidebar

2. Click "Edit mcp.json" under the Install section

3. Add the FedRAMP Docs configuration:

Config file location:

• macOS/Linux: ~/.lmstudio/mcp.json

• Windows: %USERPROFILE%\.lmstudio\mcp.json

Basic configuration:

Using full path (recommended if command not found):

4. Save the file - LM Studio will automatically load the server

5. Start chatting - Open a chat with any local model

6. Test it - Ask: "List all FedRAMP FRMR documents"

7. Approve tool calls - LM Studio will show a confirmation dialog before executing each tool

Note: Requires global installation (npm install -g .) or use the full path to the executable. Find your path with: which fedramp-docs-mcp

OpenCode

OpenCode is a powerful AI coding agent built for the terminal with native MCP support.

Setup Instructions

1. Create or edit your OpenCode configuration file:

Config file location:

• Global: ~/.config/opencode/opencode.json

• Project: opencode.json (in your project root)

2. Add the FedRAMP Docs MCP server:

Basic configuration:

With full path:

With environment variables:

3. Restart OpenCode to load the MCP server

4. Test it - The FedRAMP tools will be automatically available alongside built-in tools

Note: MCP servers add to your context, so enable only the ones you need. Use "enabled": false to temporarily disable a server without removing it.

Goose

Goose is Block's open-source AI agent. You can add the FedRAMP Docs MCP server using any of these methods:

Method 1: Via Goose CLI (Recommended)

Then select:

1. Add Extension

2. Command-line Extension

3. Enter the following details:

   • Name: FedRAMP Docs

   • Command: fedramp-docs-mcp

   • Timeout: 300

Method 2: Via Goose Desktop App

1. Open Goose Desktop

2. Click Extensions in the sidebar

3. Click Add custom extension

4. Fill in the form:

   • Extension Name: FedRAMP Docs

   • Type: STDIO

   • Command: fedramp-docs-mcp

   • Timeout: 300

   • Environment Variables: (optional)

     • FEDRAMP_DOCS_PATH: /path/to/FedRAMP/docs

     • FEDRAMP_DOCS_AUTO_UPDATE: true

Method 3: Via Config File

Edit ~/.config/goose/config.yaml (Linux/macOS) or %USERPROFILE%\.config\goose\config.yaml (Windows):

After configuration, restart Goose or reload extensions. You can test by asking: "What FedRAMP tools are available?"

Note: Goose's MCP support is still maturing and may have issues discovering tools from stdio servers. If you experience problems with tool discovery, consider using Claude Desktop, Claude Code CLI, LM Studio, or OpenCode instead.

Kiro

Kiro is AWS's spec-driven IDE with native MCP support.

Setup Instructions

1. Open Kiro MCP settings:

   • Global: ~/.kiro/settings/mcp.json

   • Project: .kiro/settings/mcp.json (takes precedence)

2. Add the FedRAMP Docs configuration:

With global installation:

3. Save the file - Kiro automatically loads MCP servers on config change

4. Test it - Ask Kiro: "List all FedRAMP FRMR documents"

Note: Requires global installation (npm install -g fedramp-docs-mcp) or use npx. Find your path with: which fedramp-docs-mcp

MCP Inspector (Debugging)

The MCP Inspector is an official tool for testing and debugging MCP servers. It provides a visual UI to interactively call tools and explore resources.

Requirements: Node.js 22.7.5 or later

Interactive UI:

Open http://localhost:6274 to access the UI, then test tools like:

• health_check - Verify the server is working

• list_frmr_documents - See all indexed FedRAMP documents

• list_ksi - Browse Key Security Indicators

CLI Mode (Quick Testing):

Export Configuration: The Inspector UI includes buttons to copy server configurations for Claude Desktop, Cursor, and other MCP clients.

Claude Plugin

The repository includes a Claude Code plugin that provides slash commands, agent skills, and a specialized compliance analyst agent.

Quick Install

In Claude Code, run:

That's it! The plugin is ready to use.

Or add an alias to your shell profile:

Available Commands

Agent Skills

• frmr-analysis - Automatically invoked when analyzing FRMR documents or control mappings

• control-mapping - Automatically invoked when mapping NIST controls to FedRAMP requirements

See plugin/README.md for full documentation.

Docker

Run the MCP server in a security-hardened Docker container.

Quick Start

Docker Compose

Claude Desktop with Docker

Configure Claude Desktop to use the Docker container:

Security Features

The Docker setup follows 2025 MCP security best practices:

• Non-root user: Runs as mcpuser (UID 1001)

• Read-only filesystem: Prevents unauthorized modifications

• Dropped capabilities: --cap-drop ALL removes all Linux capabilities

• No new privileges: Prevents privilege escalation

• Resource limits: Memory and CPU constraints

• Network isolation: Internal network with no external access by default

Development

Running in Development Mode

Use tsx for rapid iteration without building:

This runs the TypeScript source directly, automatically recompiling on changes.

Running Tests

The repository includes Vitest-based unit and contract tests with small fixtures:

Tests set FEDRAMP_DOCS_PATH to tests/fixtures/repo, ensuring the indexer, search, and diff logic run deterministically without needing the real FedRAMP repo.

Code Structure

The codebase uses:

• TypeScript 5.4+ with strict mode enabled

• ES Modules ("type": "module" in package.json)

• Node.js module resolution (moduleResolution: "NodeNext")

• Zod for runtime schema validation

• MCP SDK v1.24+ for server implementation

Project Structure

Fixtures live under tests/fixtures, while Vitest specs reside in tests/.

Troubleshooting

Build Errors

Error:

Ensure you have the correct SDK version installed:

Error:

The project uses ES modules with NodeNext resolution. Make sure you're using Node.js 18+ and that your TypeScript configuration matches:

Runtime Errors

Error:

The server couldn't clone the FedRAMP docs repository. Check:

• Network connectivity

• Set FEDRAMP_DOCS_PATH to an existing local clone, or

• Ensure FEDRAMP_DOCS_ALLOW_AUTO_CLONE=true (default)

Server starts but no tools appear

Verify the build completed successfully:

Development Issues

TypeScript errors about missing types

Install all development dependencies:

Required type packages:

• @types/node

• @types/fs-extra

• @types/lunr

• @types/glob