How do I use fedramp-docs-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@fedramp-docs-mcp list KSIs in the Access Control theme" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

fedramp-docs-mcp

by Andrew-Nolan-owl

Overview Schema Related Servers Score Discussions

Python

Remote

fedramp-docs-mcp

An unofficial Model Context Protocol (MCP) server that exposes the public FedRAMP 20x machine-readable documentation (FRMR) as deterministic, citable lookup tools for AI assistants.

⚠️ Not affiliated with FedRAMP, GSA, or the U.S. government. This is a community-built tool. Data is sourced from the public GSA FedRAMP docs repository at https://github.com/FedRAMP/docs. The bundled FRMR.documentation.json is a U.S. government work in the public domain (17 U.S.C. § 105); this server's code is MIT-licensed.

Why this exists

When using AI assistants to analyze, scope, or write about FedRAMP 20x requirements, the model can paraphrase FRMR content from memory and drift on numbers, IDs, dates, or definitions. This MCP server replaces that with structured lookups against the canonical JSON — every response carries a _source block pointing to the exact upstream commit and JSON path. The model literally cannot answer without citing the source.

Related MCP server: turva-mcp

Install

📦 PyPI release is planned but not yet published. Install directly from this GitHub repo via uvx for now. The PyPI path below will work once v0.1.0 stabilizes.

Install from GitHub (current path)

uvx can install directly from a git URL — no PyPI required, no clone needed:

uvx --from git+https://github.com/Andrew-Nolan-owl/fedramp-docs-mcp.git fedramp-docs-mcp --help

(Install uv first if needed: brew install uv on macOS, or see https://docs.astral.sh/uv/.)

You can pin to a specific tag or commit for reproducibility:

# pin to a tag
uvx --from git+https://github.com/Andrew-Nolan-owl/fedramp-docs-mcp.git@v0.1.0 fedramp-docs-mcp

# pin to a commit SHA
uvx --from git+https://github.com/Andrew-Nolan-owl/fedramp-docs-mcp.git@<sha> fedramp-docs-mcp

Install from PyPI (planned, not yet available)

Once v0.1.0 is published to PyPI, this will be the simpler path:

# Not yet — coming with v0.1.0 PyPI release
uvx fedramp-docs-mcp

Configure your MCP client

Claude Code / Claude Desktop

Add to your MCP client config (e.g., ~/.claude.json):

{
  "mcpServers": {
    "fedramp-docs": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/Andrew-Nolan-owl/fedramp-docs-mcp.git",
        "fedramp-docs-mcp"
      ]
    }
  }
}

Once the PyPI release ships, the config simplifies to:

{
  "mcpServers": {
    "fedramp-docs": {
      "command": "uvx",
      "args": ["fedramp-docs-mcp"]
    }
  }
}

Restart your client. The tools appear automatically; verify with /mcp in Claude Code.

Available tools (v0.1.0 — 20x only)

Tool	Purpose
`list_ksis(theme?)`	Enumerate Key Security Indicators (~60 across 11 themes)
`get_ksi(id)`	Full text of a KSI indicator by ID (e.g. `KSI-AFR-ADS`; legacy `KSI-AFR-03` also resolves via `fka`)
`list_frrs(status?)`	Enumerate FedRAMP Requirements & Rules sections with effective status
`get_frr_section(short_name)`	Full text of an FRR section (e.g. `ADS`, `CCM`)
`get_definition(term_or_id)`	FedRAMP Definition lookup by ID, term, or alt
`search(query, scope?)`	Full-text search across KSIs, FRRs, and FRDs
`get_source_info()`	Vendored snapshot metadata — upstream commit, fetched_at, etc.

Every response includes _source:

{
  "_source": {
    "file": "FRMR.documentation.json",
    "upstream_commit": "a06fa8f9b103c0346895fb669b721962f5891bb6",
    "upstream_url": "https://github.com/FedRAMP/docs",
    "frmr_last_updated": "2026-04-08",
    "json_path": "/KSI/AFR/indicators/KSI-AFR-ADS"
  }
}

Refreshing the FRMR snapshot

This server ships with a vendored snapshot of FRMR.documentation.json pinned to a specific upstream commit. To pull the latest:

uvx fedramp-docs-mcp refresh

Refresh is a CLI action (not an MCP tool) because it mutates local state across all future sessions. Reference servers (fetch, time) follow the same pattern.

Run refresh when:

You're starting a new work session that needs current data
Upstream has new commits at https://github.com/FedRAMP/docs
get_source_info shows a stale fetched_at

Scope

v0.1.0 surfaces only 20x-effective content (items where effective.20x.is != "no" in FRMR). Rev 5 expansion is planned for v0.3.0. See ROADMAP.md if present, or the GitHub issues.

Design notes

Framework: FastMCP (high-level decorator API in the official mcp Python SDK)
Distribution: PyPI, runnable via uvx
Data: Vendored snapshot + explicit refresh CLI (deterministic by default, fresh on demand)
Citations: Structural — every response carries _source so attribution can't be dropped or paraphrased

Development

git clone https://github.com/Andrew-Nolan-owl/fedramp-docs-mcp.git
cd fedramp-docs-mcp
uv venv
source .venv/bin/activate
uv pip install -e ".[dev]"
pytest

Contributing

Issues and PRs welcome. This is an alpha-stage tool — tool ergonomics, error messages, and search ranking are all open to iteration.

License

MIT (see LICENSE). The bundled FRMR JSON is a U.S. government work in the public domain.

Available Tools

7 tools

get_definitionA

Look up a FedRAMP Definition by ID, term, or alt name.

Args: term_or_id: An FRD ID (e.g. 'FRD-ACV'), the definition term, or an alt spelling.

ParametersJSON Schema

Name	Required	Description	Default
`term_or_id`	Yes

TDQS

A3.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must cover behavioral traits. It only states 'look up,' implying a read-only operation, but it does not disclose any side effects, permissions, error handling, or behavior when the definition is not found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise, consisting of two sentences and a brief argument list. Every sentence provides essential information without redundancy or excess.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite being a simple tool, the description lacks information about return values, error cases, or behavior when no result is found. Since no output schema exists, the description should provide this context to be fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the tool description compensates by defining the parameter term_or_id with examples ('FRD-ACV') and acceptable value types (ID, term, alt spelling). This adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it looks up a FedRAMP Definition by ID, term, or alt name. The verb 'look up' and resource 'FedRAMP Definition' are specific, and the input types are explicitly listed, distinguishing it from sibling tools like search or list operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when one needs a definition by a known identifier or term, but it does not explicitly state when to use this tool versus alternatives like get_frr_section or search. No exclusions or alternative suggestions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_frr_sectionA

Get full text of a 20x-effective FRR section.

Args: short_name: Section short_name, e.g. 'ADS', 'CCM', 'FSI'.

ParametersJSON Schema

Name	Required	Description	Default
`short_name`	Yes

TDQS

A3.5/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden for behavioral disclosure. It only states that it returns full text, but does not mention permissions, rate limits, error handling, or any side effects. The term '20x-effective' is vague and not explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences that directly state the purpose and parameter format. Every word is necessary, and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description provides adequate information to understand the action and the required input. However, it lacks details about the return value structure, potential errors, or the meaning of '20x-effective', which could be helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the 'short_name' parameter with examples ('e.g. 'ADS', 'CCM', 'FSI''), adding significant meaning beyond the schema's type-only definition. This helps the agent understand valid inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get full text') and the resource ('20x-effective FRR section'). It distinguishes from sibling tools like 'list_frrs' (which lists) and 'get_definition' (which likely gets a definition), making the purpose specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. There is no mention of prerequisites, exclusions, or scenarios where another tool might be preferred. The usage context is only implied by the action description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ksiA

Get full text of a single KSI indicator.

Args: id: The KSI indicator ID, e.g. 'KSI-AFR-ADS'. Legacy numeric IDs ('KSI-AFR-03') also resolve via the indicator's fka field.

ParametersJSON Schema

Name	Required	Description	Default
`id`	Yes

TDQS

A3.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided and description lacks behavioral details such as idempotency, rate limits, or auth requirements beyond implying a read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: one sentence plus a single arg description. No superfluous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequately covers the tool's purpose and parameter usage for a simple getter; minor lack of explicit return value statement but implied by name.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description adds significant meaning to the single parameter 'id' with examples and explanation of legacy numeric ID resolution via 'fka' field, far beyond the schema's bare type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'Get' and resource 'full text of a single KSI indicator', distinguishing from siblings like list_ksis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use vs alternatives like list_ksis or search; context must be inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_source_infoA

Return metadata about the active FRMR snapshot.

Reports upstream commit, frmr_version, fetched_at, and whether the active source is the bundled snapshot or a user-refreshed cache. Run fedramp-docs-mcp refresh from the CLI to update.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It clearly describes the non-destructive nature (return metadata) and specifies the returned fields. However, it does not disclose potential error conditions or performance characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loaded with the primary purpose. Every sentence adds necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple metadata retrieval tool with no parameters and no output schema, the description is mostly complete. It specifies the returned fields and the source distinction. Missing details about error states or edge cases, but acceptable given simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters and 100% schema coverage, the baseline is 4. The description adds value by explaining what the tool returns, which goes beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Describes a specific verb-resource combination: 'Return metadata about the active FRMR snapshot.' Lists specific fields and distinguishes itself from siblings like get_definition or search, which deal with content rather than snapshot metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for obtaining snapshot metadata but does not explicitly state when to use this tool versus alternatives like get_definition or search. It mentions a CLI command for refreshing, which is tangentially related but not a direct usage guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_frrsB

Enumerate 20x FedRAMP Requirements & Rules (FRR) sections.

Args: status: Optional filter on effective.current_status (e.g. 'Open Beta', 'GA').

ParametersJSON Schema

Name	Required	Description	Default
`status`	No

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. The description implies a read operation ('enumerate') but lacks disclosure on side effects, rate limits, or pagination behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise, front-loaded purpose, no redundant text. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Sufficient for a simple list tool with one optional parameter, but lacking output schema means the agent cannot anticipate the return format or fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by explaining the 'status' parameter as an optional filter on effective.current_status with examples ('Open Beta', 'GA'), adding significant meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool enumerates FRR sections, but does not distinguish it from sibling tools like get_frr_section (which likely retrieves a single section).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like get_frr_section, get_definition, or search. The optional status filter is mentioned but without context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_ksisB

Enumerate FedRAMP 20x Key Security Indicators (KSIs).

Args: theme: Optional theme short_name to filter by (e.g. 'AFR', 'IAM', 'CMT').

ParametersJSON Schema

Name	Required	Description	Default
`theme`	No

TDQS

B3.1/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Does not disclose behavioral traits such as pagination, read-only status, authentication requirements, rate limits, or mutation potential. Only states 'enumerate' without further details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: two sentences covering the purpose and parameter. No wasted words, front-loaded with the action and resource. Efficient for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description fails to explain return structure (e.g., list of KSI objects, fields), pagination, or default behavior. Essential info for a list endpoint is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Adds meaning beyond the input schema (which only has type/name) by providing examples ('AFR', 'IAM', 'CMT') and clarifying the filter purpose. However, it lacks full enumeration or constraints, which would warrant a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Enumerate FedRAMP 20x Key Security Indicators (KSIs)', which distinguishes it from the sibling 'get_ksi' (which retrieves a single KSI). However, it does not explicitly differentiate from 'list_frrs' or 'search', but the tool name implies a listing operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus siblings like 'get_ksi' (single record retrieval) or 'search' (likely filtered query). Missing context about use cases or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

searchA

Full-text search across KSIs, FRRs, and FRDs.

Args: query: Search string (case-insensitive substring match). scope: Optional 'KSI' | 'FRR' | 'FRD' to narrow the search.

ParametersJSON Schema

Name	Required	Description	Default
`query`	Yes
`scope`	No

TDQS

A3.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behaviors such as read-only nature, pagination, result limits, or authorization requirements. The description only covers basic functionality.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief, front-loads the core purpose in the first sentence, and then lists parameters in a clear, structured format. No redundant or extraneous content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description lacks information about return format, pagination, error handling, or max results. For a search tool, these details are important for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description adds meaningful parameter details: query is 'case-insensitive substring match' and scope is optional with enumerated values ('KSI', 'FRR', 'FRD'). This compensates for the schema's minimal information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Full-text search across KSIs, FRRs, and FRDs,' specifying the verb (search) and the resources (KSIs, FRRs, FRDs). This distinguishes it from sibling tools like get_ksi or list_frrs, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching across document types but does not explicitly state when to use this tool versus alternatives like get_ksi or list_frrs. There are no when-not-to-use or prerequisite details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.7/5.0

Disambiguation5/5

Each tool targets a distinct resource and action: definitions, FRR sections, KSI indicators, source info, listings for FRRs and KSIs, and cross-document search. There is no overlap in functionality, making it easy for an agent to select the correct tool.

Naming Consistency4/5

Tool names follow a mostly consistent verb_noun pattern using snake_case (e.g., get_definition, list_frrs). The outlier is 'search' which lacks a noun suffix, but it remains clear and standard for a search tool.

Tool Count5/5

Seven tools is well-scoped for a documentation retrieval server focused on FedRAMP definitions, rules, and indicators. Each tool serves a clear purpose without unnecessary redundancy or missing essential operations.

Completeness4/5

The tool set covers retrieval (get), listing (list with filters), and search for the three document types (FRDs, FRRs, KSIs), plus source metadata. A minor gap is the absence of a dedicated list_tools for definitions, but search partially mitigates this.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

UnifAPI
com.unifapi
Hosted MCP server for live public-data APIs and Skills for AI agents.
Open Data Search AI & Machine Learning
2
jumpcloud-genaiOAuth
com.jumpcloud
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
Cloud Platforms Security Developer Tools
2
turva-mcp A
dev.turva
Read-only MCP server for turva.dev, an agent-readiness audit and advisory service.
Autonomous Agents Security Developer Tools
42
MedPrice AI A
io.github.medprice-ai
Hosted MCP server exposing US hospital procedure cost data to AI assistants
Biology & Medicine Finance
52

Related MCP Servers

Grounded Code MCP
RAG Systems Knowledge & Memory
michaelalber
A
license
Not graded
quality
B
maintenance
A local MCP server that gives AI coding assistants retrieval access to your personal knowledge base of books, standards, and docs, grounding their answers in sources you trust.
Updated 2 months ago (2026-07-14 03:40 UTC)
MIT
turva-mcp
Security AI & Machine Learning
erekola
A
license
Not graded
quality
A
maintenance
Public read-only MCP server for turva.dev's agent-readiness audit, enabling AI agents to query service catalog, security evidence, and engagement principles via structured JSON.
Updated 4 hours ago (2026-09-03 12:48 UTC)
1
MIT
tardigrade-shield
Security
Blu5Morpheus
A
license
Not graded
quality
C
maintenance
Model-agnostic cybersecurity MCP server for CMMC 2.0 compliance workflows with air-gapped Ollama mode.
Updated 2 months ago (2026-07-16 15:04 UTC)
MIT
samgov-mcp
Government Data Open Data
juanmplazasg-lgtm
F
license
A
quality
C
maintenance
MCP server for querying SAM.gov federal contract opportunities, providing precise search, retrieval, and attachment tools with full source traceability and explicit abstention when data is absent.
Updated a month ago (2026-08-07 18:36 UTC)
5

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Andrew-Nolan-owl/fedramp-docs-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server