FedRAMP Docs MCP Server

{
  "info": {
    "title": "FedRAMP Machine-Readable Documentation",
    "version": "0.9.2-beta",
    "last_updated": "2026-02-11"
  },
  "FRD": {
    "info": {
      "name": "FedRAMP Definitions",
      "short_name": "FRD"
    },
    "data": {
      "both": {
        "FRD-ACV": {
          "term": "Accepted Vulnerability",
          "alts": ["accepted vulnerability"],
          "definition": "A vulnerability not fully remediated within accepted timelines."
        },
        "FRD-ANA": {
          "term": "All Necessary Assessors",
          "definition": "All entities that participate in the FedRAMP assessment."
        }
      }
    }
  },
  "KSI": {
    "IAM": {
      "id": "KSI-IAM",
      "short_name": "IAM",
      "name": "Identity and Access Management",
      "theme": "A secure cloud service offering controls access and user identity.",
      "indicators": {
        "KSI-IAM-AAM": {
          "name": "Automating Account Management",
          "statement": "Securely manage account lifecycle and access using automation.",
          "controls": ["ac-2.2", "ia-12"],
          "impact": {
            "low": true,
            "moderate": true,
            "high": true
          }
        },
        "KSI-IAM-APM": {
          "name": "Adopting Passwordless Methods",
          "statement": "Use secure passwordless methods where feasible.",
          "controls": ["ia-2.1", "ia-5.2"],
          "impact": {
            "low": false,
            "moderate": true,
            "high": true
          }
        }
      }
    },
    "CNA": {
      "id": "KSI-CNA",
      "short_name": "CNA",
      "name": "Cloud Native Architecture",
      "theme": "A secure cloud service offering uses cloud-native security guardrails.",
      "indicators": {
        "KSI-CNA-CIC": {
          "name": "Container Image Controls",
          "statement": "Continuously scan and harden container images.",
          "controls": ["sc-13", "sc-28"],
          "impact": {
            "high": true
          }
        }
      }
    }
  },
  "FRR": {
    "MAS": {
      "info": {
        "name": "Minimum Assessment Scope",
        "short_name": "MAS"
      },
      "data": {
        "both": {
          "CSO": {
            "MAS-CSO-IIR": {
              "name": "Identify Information Resources",
              "statement": "Providers MUST identify information resources in scope for authorization.",
              "controls": ["ac-2", "sc-7"]
            },
            "MAS-CSO-MDI": {
              "name": "Metadata Inclusion",
              "statement": "Providers MUST include metadata in scope decisions where applicable."
            }
          }
        }
      }
    },
    "SCG": {
      "info": {
        "name": "Secure Configuration Guide",
        "short_name": "SCG"
      },
      "data": {
        "both": {
          "CFG": {
            "SCG-CFG-BAS": {
              "name": "Baseline Configurations",
              "statement": "Providers MUST maintain baseline secure configurations.",
              "controls": ["cm-2.7"]
            }
          }
        }
      }
    },
    "SCN": {
      "info": {
        "name": "Significant Change Notifications",
        "short_name": "SCN"
      },
      "data": {
        "both": {
          "SCR": {
            "SCN-SCR-MAJ": {
              "name": "Major Significant Change",
              "statement": "Providers MUST submit a significant change notification before major architecture changes.",
              "controls": ["cm-3"]
            }
          }
        }
      }
    }
  }
}