Security Controls MCP Server
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Security Controls MCP ServerMap ISO 27001 A.5.15 to DORA controls"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Security Controls MCP Server
▶ Try this MCP instantly via Ansvar Gateway
50 free queries/day · no card required · OAuth signup at ansvar.eu/gateway
One endpoint, one OAuth signup, access from any MCP-compatible client.
Connect
Claude Code (one line):
claude mcp add ansvar --transport http https://gateway.ansvar.eu/mcpClaude Desktop / Cursor — add to claude_desktop_config.json (or mcp.json):
{
"mcpServers": {
"ansvar": {
"type": "url",
"url": "https://gateway.ansvar.eu/mcp"
}
}
}Claude.ai — Settings → Connectors → Add custom connector → paste https://gateway.ansvar.eu/mcp
First request opens an OAuth flow at ansvar.eu/gateway. After signup, your client is bound to your account; tier (free / premium / team / company) determines fan-out, quota, and which downstream MCPs are reachable.
Self-host this MCP
You can also clone this repo and build the corpus yourself. The schema, fetcher, and tool implementations all live here. What is not in the repo is the pre-built database — TDM and standards-licensing constraints on the upstream sources mean we host the corpus on Ansvar infrastructure rather than redistribute it as a public artifact.
Build your own: run this repo's ingestion script (entry-point varies per
repo — typically scripts/ingest.sh, npm run ingest, or make ingest;
check the repo root).
Related MCP server: Security Context MCP Server
Overview
THE definitive MCP server for security framework mapping. Makes 1,451 security controls across 262 SCF-mapped frameworks searchable and AI-accessible through Claude, Cursor, or any MCP-compatible client.
Built on the Secure Controls Framework (SCF) by ComplianceForge.
Key capabilities:
1,451 security controls across governance, risk, compliance, and technical domains
262 SCF-mapped frameworks including ISO 27001, NIST CSF, DORA, PCI DSS, CMMC, and TIBER-EU
AI Governance: ISO 42001, NIST AI RMF, EU AI Act, Cyber Resilience Act
Bidirectional mapping between frameworks via SCF rosetta stone
Bundled public national framework profiles for BIO, KATAKRI, NSM, MSB, CFCS, CCB, and ANSSI
Optional integration with purchased standards (ISO, NIST 800-53) for official text
Full-text search across all control descriptions
Natural language queries instead of framework-specific IDs
Why This Exists
Different frameworks describe the same security measures in different ways. ISO 27001 has one control ID, NIST CSF has another, PCI DSS has yet another — but they're all talking about the same thing.
This MCP server provides instant bidirectional mapping between any two frameworks via the SCF rosetta stone. Ask Claude "What DORA controls does ISO 27001 A.5.15 map to?" and get an immediate answer backed by ComplianceForge's framework database.
Example Queries
"What does GOV-01 require?"
"Search for controls about encryption key management"
"What ISO 27001 controls map to DORA?"
"List all controls needed for PCI DSS compliance"
"Which DORA requirements does ISO 27001 A.5.15 satisfy?"
"Show me all NIST CSF 2.0 controls related to incident response"
NEW: "What ISO 42001 controls map to NIST AI RMF?"
NEW: "Show me EU AI Act requirements for high-risk AI systems"
Available Frameworks (262)
AI Governance (NEW in v0.4.0)
ISO 42001:2023 (149) - AI Management System
NIST AI RMF 1.0 (158) - AI Risk Management Framework
NIST AI 600-1 (139) - Generative AI Profile
EU AI Act (119) - Regulation 2024/1689
EU Cyber Resilience Act (18)
Core Frameworks
US Government: NIST 800-53 R5 (777), NIST CSF 2.0 (253), FedRAMP R5 (423), CMMC 2.0 (198/52)
International Standards: ISO 27001 (51), ISO 27002 (316), ISO 27017 (119), ISO 27018 (70), ISO 27701 (187), ISO 22301 (52)
US Industry: PCI DSS v4.0.1 (364), SOC 2 (412), HIPAA (136), SOX (2)
Financial: SWIFT CSCF 2023 (127), FFIEC (231), GLBA (108), DORA (103)
Cloud: CSA CCM v4 (334), Germany C5 (239)
Regional Coverage (50+ countries)
APAC: Australia ISM/Essential 8, Singapore MAS TRM, Japan ISMAP, China Cybersecurity Law, India DPDPA
EU: GDPR (42), NIS2 (68), PSD2 (61), plus 20+ national frameworks
Americas: US state laws (CA, NY, TX, etc.), Brazil LGPD, Canada PIPEDA
Middle East/Africa: Saudi SAMA, UAE NIAF, South Africa POPIA
Specialized
Industrial/OT: IEC 62443 (197), NERC CIP (224), NIST 800-82
Automotive: ISO/SAE 21434, TISAX, UN R155
Healthcare/MedDev: HIPAA, HITRUST, CMS MARS-E, IEC 81001-5-1, IMDRF N60/N73, FDA Premarket Cybersecurity
See docs/coverage.md for the complete list of 262 SCF-mapped frameworks.
Tools
Core Tools
version_info() - Get server version, statistics, and top frameworks
Call this first to understand what data is available
list_frameworks() - List all 262 SCF-mapped frameworks with control counts
get_control(control_id) - Get full details for a specific SCF control
Returns description, domain, weight, PPTDF category, and mappings to all 262 SCF-mapped frameworks
search_controls(query, frameworks=[], limit=10) - Search controls by keyword
Optional framework filtering
Full-text search across names and descriptions
get_framework_controls(framework) - Get all controls for a specific framework
Returns controls organized by domain
map_frameworks(source_framework, target_framework, source_control=None) - Map between frameworks
Bidirectional mapping via SCF
Optional filtering to specific source control
Standards Tools
list_available_standards() - List all available standards (SCF + bundled public profiles + imported)
query_standard(standard, query, limit=10) - Search within a bundled public profile or purchased standard
Bundled public profiles return curated summaries with official source links
Purchased standards require import first and return clause text from the user's copy
get_clause(standard, clause_id) - Get a specific clause or section
Bundled public profiles return curated summary sections
Purchased standards require import first for official clause text
Bundled Public National Profiles
These profiles are available immediately after install and are sourced from official public publications:
netherlands_bio- Netherlands BIO2finland_katakri- Finland KATAKRI 2020norway_nsm- Norway NSM Basic Principles for ICT Securitysweden_msb- Sweden MSB information security and incident reporting profiledenmark_cfcs- Denmark CFCS cyber defence profilebelgium_ccb- Belgium CyberFundamentals (CyFun)france_anssi- France ANSSI cyber hygiene baseline
See PAID_STANDARDS_GUIDE.md for import instructions.
Add Purchased Standards (Optional)
Import your purchased ISO 27001, NIST SP 800-53, or other standards to get official text alongside SCF descriptions:
# Install import tools
pip install security-controls-mcp[import-tools]
# Import purchased PDF
scf-mcp-import import-standard \
--file ~/Downloads/ISO-27001-2022.pdf \
--type iso_27001_2022 \
--title "ISO/IEC 27001:2022"
# Restart MCP, then queryYour paid content stays private in ~/.security-controls-mcp/ (never committed to git).
Full guide: PAID_STANDARDS_GUIDE.md
Technical Architecture
Data Pipeline: SCF JSON → In-memory index → MCP tools → AI response
Key principles:
All control text returns verbatim from SCF source with zero LLM paraphrasing
Framework mappings use ComplianceForge's authoritative crosswalks
Optional purchased standards stored locally (never committed)
Search results optimized for AI context windows
Data integrity:
SCF version locked to 2025.4 for consistency
All mappings sourced from official SCF framework crosswalks
User-imported standards require valid licenses
Data Source
Based on SCF 2025.4 (released December 29, 2025)
1,451 controls across all domains
262 SCF-mapped frameworks with full mapping coverage
Licensed under Creative Commons (data)
Source: ComplianceForge SCF
Included data files:
scf-controls.json- All 1,451 controls with framework mappingsframework-to-scf.json- Reverse index for framework-to-SCF lookups
More Ansvar MCPs
Full fleet at ansvar.eu/gateway.
Development
Branching Strategy
This repository uses a dev integration branch. Do not push directly to main.
feature-branch → PR to dev → verify on dev → PR to main → deploymainis production-ready. Only receives merges fromdevvia PR.devis the integration branch. All changes land here first.Feature branches are created from
dev.
Setup
# Clone and install
git clone https://github.com/Ansvar-Systems/security-controls-mcp.git
cd security-controls-mcp
pip install -e '.[dev]'
# Install pre-commit hooks
pre-commit install
# Run tests
pytest tests/ -vPre-commit hooks run automatically before each commit:
Code formatting (black, ruff)
Linting (ruff check, YAML/JSON validation)
Tests (pytest, smoke tests, server startup)
Bypass hooks (emergencies only): git commit --no-verify
Important Disclaimers
Not Legal or Compliance Advice: Control text is sourced directly from official SCF data, but this tool should not be used as the sole basis for compliance decisions. Always verify against official framework sources and consult qualified compliance professionals.
AI Content Restrictions: The SCF license explicitly prohibits using AI systems to generate derivative content such as policies, standards, procedures, metrics, risks, or threats based on SCF data. You may query and analyze controls, but not generate derivative compliance artifacts.
Purchased Standards: Optional standards imports require valid licenses. You must own legitimate copies and comply with copyright restrictions. This tool does not include or distribute any copyrighted standards text.
Framework Coverage: While SCF provides comprehensive mappings, not all controls map 1:1 across frameworks. Always review official framework documentation for authoritative requirements.
License
Code: Apache License 2.0 (see LICENSE)
Data: Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0) by ComplianceForge
Source: Secure Controls Framework (SCF)
Version: SCF 2025.4 (December 29, 2025)
What you MAY do:
Query and analyze SCF controls
Map between frameworks
Reference controls in your own work (with attribution)
Use this MCP server to understand control requirements
What you MAY NOT do:
Use AI to generate policies or procedures based on SCF controls
Create derivative frameworks or modified versions for distribution
Remove or modify control definitions
For complete terms: SCF Terms & Conditions
More Open Source from Ansvar
We maintain a family of MCP servers for compliance and security professionals:
Server | Description | Install |
Offline sanctions screening with OpenSanctions (30+ lists) | via Ansvar Gateway |
Browse all projects: ansvar.eu/open-source
Built by: Ansvar Systems (Stockholm, Sweden)
Available Tools
14 toolsaboutA
Returns structured JSON with server metadata, dataset provenance, data fingerprint, freshness indicators, and security posture. Use this to verify data currency and coverage before relying on results. Prefer this over version_info when you need machine-readable metadata. Returns ~800 tokens.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses return content and token size (~800 tokens). No annotations provided, but as a read-only metadata tool, the description covers key behavioral aspects. No harmful side effects implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise: three sentences, front-loaded with purpose, usage, and preference. Every sentence adds useful information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but the description enumerates return components (metadata, provenance, etc.) and mentions token count. Sufficient for a no-parameter info tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. The description adds value by specifying what the result contains, which compensates for the lack of param details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns structured JSON with specific metadata components (provenance, fingerprint, freshness, security posture). It distinguishes from sibling 'version_info' by noting preference when machine-readable metadata is needed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'verify data currency and coverage before relying on results.' Also provides alternative: 'Prefer this over version_info when you need machine-readable metadata.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diff_controlA
Shows what changed in an SCF control between two SCF releases. Returns a change summary and affected framework mappings. Premium feature — requires Ansvar Intelligence Portal.
| Name | Required | Description | Default |
|---|---|---|---|
| control_id | Yes | SCF control ID (e.g., "GOV-01") | |
| from_version | Yes | SCF release version (e.g., "2024.4") | |
| to_version | No | SCF release version (defaults to current) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions the premium feature and portal requirement, but lacks details on safety (read-only), error handling, rate limits, or side effects. The description does not contradict any annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences, no redundant information, and front-loaded purpose. Every sentence provides value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so description should explain return values. It mentions 'change summary and affected framework mappings' but lacks detail on format, pagination, or example. For a tool with 3 params and moderate complexity, it is adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description does not add meaningful parameter semantics beyond what the schema already provides (control_id pattern, version examples). The premium note is unrelated to parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool shows changes in an SCF control between two releases, with specific output of a change summary and affected framework mappings. It distinguishes itself from siblings like get_control or get_control_history by focusing on diffing specific versions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for comparing two SCF releases but does not provide explicit when-to-use or when-not-to-use guidance relative to sibling tools like get_control_history or get_framework_changes. No alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_clauseA
Get a specific clause or section from a bundled public framework profile or a purchased standard by its clause ID. Bundled public profiles return curated summary text with official source attribution. Purchased standards return text from the user's imported copy with license notice. If the clause is not found, returns an error message. Use query_standard to discover clause IDs first.
| Name | Required | Description | Default |
|---|---|---|---|
| standard | Yes | Standard identifier (e.g., 'netherlands_bio', 'iso_27001_2022'). Use list_available_standards to see available standards. | |
| clause_id | Yes | Clause or section identifier within the standard (e.g., '5.1.2', 'A.5.15' for ISO 27001, 'AC-1' for NIST 800-53). Use query_standard to discover valid IDs. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses different content sources (curated summary vs. user copy), attribution/license notice, and error behavior. No annotations exist, so description carries full burden and does well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with core purpose, each sentence adds unique value. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema or annotations, description explains behavior for both source types, error handling, and usage hints. Slightly lacking return format details but acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are well-documented. Description adds context about source types but not deeper semantics. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool gets a specific clause or section from public or purchased standards, differentiating from siblings like get_control or get_provision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises using query_standard to discover clause IDs first, and mentions error handling. Does not explicitly state when not to use, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_controlA
Retrieve a specific SCF control by its exact ID. Returns the control's domain, description, weight (1-10 criticality), PPTDF classification, validation cadence, and optionally all framework mappings. Use this when you already know the control ID (e.g., GOV-01, IAC-05, CRY-01). If you don't know the ID, use search_controls first. Returns 'not found' for invalid IDs. With include_mappings=true (default), returns ~1000-3000 tokens depending on how many frameworks map to this control. Set include_mappings=false to reduce to ~200 tokens.
| Name | Required | Description | Default |
|---|---|---|---|
| control_id | Yes | SCF control ID in format DOMAIN-NN (e.g., GOV-01, IAC-05, CRY-01, NET-01). Use search_controls to discover valid IDs. | |
| include_mappings | No | Include cross-framework mappings in the response. Set to false to reduce token usage when you only need the control description. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully covers behavioral traits: it discloses the return values (domain, description, etc.), warns about token sizes (~1000-3000 vs ~200 tokens), and explicitly states that invalid IDs return 'not found'. This is comprehensive transparency for a read-only retrieval tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with the main purpose first, followed by usage guidance, behavior notes, and parameter details. All sentences add value, though there is slight redundancy in mentioning token sizes twice. It is front-loaded and concise enough, but could be trimmed slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description adequately explains what the tool returns (domain, description, weight, etc.), covers error behavior ('not found'), and provides token size estimates. Combined with the schema's parameter descriptions, it gives a complete picture for an agent to use the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema already provides descriptions for both parameters (control_id with pattern and include_mappings with default/description), the description adds significant meaning: it provides concrete ID examples, explains the token size implications of include_mappings, and reinforces the relationship with search_controls for discovering valid IDs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieve a specific SCF control by its exact ID' and lists the returned fields (domain, description, weight, PPTDF classification, etc.), with explicit examples of control IDs. It distinguishes itself from sibling tool search_controls by specifying the precondition of knowing the ID.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use this tool ('when you already know the control ID') and when not to ('If you don't know the ID, use search_controls first'). It also provides guidance on the include_mappings parameter, advising to set it to false to reduce token usage when only the control description is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_control_historyA
Returns the full version timeline for a specific SCF control. Shows when the control was added, modified, or removed across SCF releases. Premium feature — requires Ansvar Intelligence Portal.
| Name | Required | Description | Default |
|---|---|---|---|
| control_id | Yes | SCF control ID (e.g., "GOV-01", "IAC-05") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Discloses it returns timeline (read-only) and premium requirement. Does not mention potential data volume, pagination, or any other behavioral traits beyond basic functionality.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two succinct sentences covering purpose and prerequisite. No wasted words, front-loaded with key action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 1-parameter query tool without output schema, description adequately explains what it does and a key prerequisite. Minor gap: lacks mention of return format, but acceptable given simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with control_id well-described via pattern and description. Description adds minimal extra meaning beyond the schema (e.g., 'SCF control ID' already in schema). Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it returns the full version timeline for a specific SCF control, with specific actions (added, modified, removed) across releases. This differentiates it from siblings like get_control or diff_control.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage for retrieving version history, and mentions premium feature requirement. However, no explicit guidance on when to use this vs alternatives like get_framework_changes or diff_control.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_framework_changesA
Lists all SCF control changes that affected a specific framework's mappings. Useful for monitoring how framework coverage evolves across releases. Premium feature — requires Ansvar Intelligence Portal.
| Name | Required | Description | Default |
|---|---|---|---|
| framework | Yes | Framework key (e.g., "iso_27001_2022", "nist_csf_2.0") | |
| since | No | ISO date to look back from (e.g., "2024-01-01") | |
| limit | No | Max results (default: 50, max: 200) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It adds the premium feature access requirement ('requires Ansvar Intelligence Portal'), but does not disclose other behaviors like pagination, sorting, or typical response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the purpose and usage, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three well-documented parameters and no output schema, the description adequately covers purpose, usage, and access constraints. Could be slightly improved by noting return format or limits beyond the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds no additional meaning beyond what the schema already provides for the three parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists 'SCF control changes that affected a specific framework's mappings', providing a specific verb and resource scope that distinguishes it from sibling tools like get_framework_controls and get_control_history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Useful for monitoring how framework coverage evolves across releases', giving a clear use case. However, it does not provide when-not-to-use or alternative tools, though the sibling list offers context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_framework_controlsA
Get all SCF controls that map to a specific framework, grouped by domain. WARNING: Large frameworks like NIST 800-53 can return 700+ controls (~5000 tokens with descriptions, ~2000 without). Set include_descriptions=false (default) to reduce token usage. Controls are capped at 10 per domain with overflow indicated. Returns 'not found' with a list of valid framework keys if the framework doesn't exist. Use list_frameworks to discover valid keys.
| Name | Required | Description | Default |
|---|---|---|---|
| framework | Yes | Framework key (e.g., 'iso_27001_2022', 'nist_csf_2.0', 'dora', 'pci_dss_4.0.1'). Use list_frameworks to discover valid keys. | |
| include_descriptions | No | Include control descriptions in the response. Significantly increases token usage (~2.5x). Default: false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavior: grouping, default parameter values, token impact, cap of 10 per domain with overflow indication, and error response format. No contradictions with annotations (none exist).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise yet thorough: a single opening sentence for purpose, then a clear warning, parameter advice, and fallback behavior. Every sentence adds necessary information; no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (large frameworks, grouping, cap, error handling, token usage) and absence of output schema, the description covers all critical aspects: response structure, edge cases, and performance considerations. It is fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema coverage is 100%, the description adds significant value: explains the trade-off of include_descriptions (2.5x token increase), states default false, and clarifies that framework key must be valid via list_frameworks. This goes well beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('all SCF controls'), specifies grouping ('grouped by domain'), and implicitly distinguishes from siblings like get_control (single) or search_controls (search). The resource and scope are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use (for specific framework keys), warns about large frameworks and token usage, advises setting include_descriptions=false by default, and directs to list_frameworks for key discovery. Also describes fallback behavior on invalid framework. The guidelines are comprehensive and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_provisionA
Look up the SCF controls mapped to a security-framework provision reference, or fetch one SCF control directly with law='SCF'. Examples: law='ISO_27001', article='6.1.1'; law='IEC_62443', article='SR 1.1'; law='SCF', article='GOV-01'. Accepts gateway framework keys (ISO_27001, ISO_27002, NIST_CSF, NIST_800_53, IEC_62443, PCI_DSS, SOC_2, CIS, CMMC, COBIT, HIPAA) or any SCF framework key from list_frameworks (e.g. 'iso_27001_2022'). A bare parent ref (e.g. '6.1') matches all sub-references ('6.1.1', '6.1.2', ...). Returns a JSON envelope {results, _meta} with per-item _citation metadata. Body text is always the SCF control catalog (CC BY-ND 4.0) — this server does not redistribute framework body text. Returns up to 10 controls (~150 tokens each).
| Name | Required | Description | Default |
|---|---|---|---|
| law | Yes | Framework key: a gateway canonical key (e.g. ISO_27001, NIST_CSF), an SCF framework key from list_frameworks (e.g. 'iso_27001_2022'), or 'SCF' for a direct SCF control lookup. | |
| article | Yes | Provision reference within the framework (e.g. '6.1.1', 'SR 1.1', 'AC-2'), or the SCF control ID (e.g. 'GOV-01') when law='SCF'. | |
| jurisdiction | No | Accepted for gateway compatibility; ignored — security frameworks are not jurisdiction-scoped. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully carries the burden. It discloses that results are limited to 10 controls, body text is only the SCF catalog (CC license), and returns a JSON envelope with _citation metadata. No side effects are expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but every sentence adds value. It is front-loaded with the main purpose and examples, though could be slightly trimmed without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the return format and limitations. It covers all key behavioral aspects for a lookup tool with 3 parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% so baseline is 3. The description adds value by providing framework key examples, explaining bare parent ref matching, and clarifying that jurisdiction is ignored.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it looks up SCF controls by framework provision reference or direct SCF control ID. It provides concrete examples and explains bare parent ref matching. This distinguishes it from sibling tools like get_control or search_controls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives examples for various framework keys and explains the jurisdiction parameter is ignored. It doesn't explicitly state when not to use this tool versus alternatives, but the examples make usage clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_available_standardsA
List all available standards: SCF (always built-in), bundled public framework profiles shipped with the server, plus any purchased standards the user has imported via PDF upload. Bundled public profiles provide curated summaries linked to official sources. Purchased standards provide official clause text from the user's imported copy. Returns ~200-800 tokens.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but the description discloses return token range (~200-800) and differentiates standard content types. It does not mention side effects or auth needs, but for a read-only list this is sufficient transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the primary action, no wasted words. Every sentence adds meaningful detail about standard types and token size.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter list tool with no output schema, the description fully covers purpose, content types, and expected output size. No gaps for the agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. The description adds value by explaining what each listed standard provides beyond what the schema (empty) conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool lists all available standards (SCF, bundled public profiles, purchased standards) and distinguishes the content of each type, providing specific verb and resource scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for listing standards and gives context on standard types, but does not explicitly state when to use over alternatives like search_controls or get_clause. However, the simplicity and zero-parameter design make usage clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_frameworksA
List all 249 supported security frameworks, optionally filtered by category. Without a category filter, returns all frameworks grouped by category (~3000 tokens). With a category filter, returns only that category's frameworks (~200-500 tokens). Use this to discover valid framework keys for get_framework_controls and map_frameworks. Returns an error listing valid categories if an invalid category is given.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | Filter to a specific category. Omit to see all categories with their frameworks. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It discloses behavior: returns grouped/list, error on invalid category, and token estimates. It implies read-only, which is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences with no redundancy. Key information is front-loaded: 'List all 249 supported security frameworks'. Every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description adequately explains what is returned (grouped by category, filtered list, or error with valid categories). No missing details for this low-complexity tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for the parameter. The description adds token size context and error behavior, providing extra value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists security frameworks with optional category filtering. It distinguishes from sibling tools by specifying its role in discovering valid framework keys for get_framework_controls and map_frameworks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use with/without category based on token size, and that it's for discovering framework keys. Could explicitly state when not to use it, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
map_frameworksA
Map controls between two frameworks via SCF as a rosetta stone. Shows which target framework requirements are satisfied by source framework controls, and identifies gaps where no mapping exists. Useful for gap analysis and compliance mapping. Results are capped at 20 mappings; use source_control to filter to a specific control for detailed mapping. Returns 'not found' if either framework key is invalid. Typical response: ~1500-3000 tokens.
| Name | Required | Description | Default |
|---|---|---|---|
| source_framework | Yes | Source framework key - the framework you HAVE implemented (e.g., 'iso_27001_2022'). Use list_frameworks to discover keys. | |
| source_control | No | Optional: filter to a specific source control ID (e.g., 'A.5.15' for ISO 27001, 'PR.AC-1' for NIST CSF) to see its specific mappings to the target framework. | |
| target_framework | Yes | Target framework key - the framework you want to SATISFY (e.g., 'dora', 'nist_800_53_r5'). Use list_frameworks to discover keys. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description discloses key behaviors: result cap of 20, filter option for detailed mapping, error response on invalid keys, and typical response token size. Adequate for a read-only mapping tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise 4-sentence description: first sentence states purpose, second explains output, third gives use case and limitation, fourth provides error and size info. No redundant sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description explains what the tool returns (satisfied requirements, gaps, 'not found'), typical response size, and error handling. Lacks output schema but enough for an agent to understand the mapping output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with descriptions. Description adds value by explaining the relationship between source_control and the result cap, providing usage context beyond schema definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool maps controls between two frameworks using SCF, specifying it shows satisfied requirements and gaps. Distinguishes from siblings like get_framework_controls that list controls without cross-mapping.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes use case (gap analysis, compliance mapping) and provides specific guidance: results capped at 20, use source_control for detailed mapping, and error behavior for invalid keys. Lacks explicit comparison with sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_standardA
Search within a bundled public framework profile or a purchased standard by keyword. Bundled public profiles contain curated summaries linked to official sources. Purchased standards return text from the user's imported copy. Returns matching clauses with text snippets. If the standard is not found, returns available standard IDs. Use list_available_standards to check what's available before calling. Returns ~500-2000 tokens depending on matches.
| Name | Required | Description | Default |
|---|---|---|---|
| standard | Yes | Standard identifier (e.g., 'netherlands_bio', 'france_anssi', 'iso_27001_2022'). Use list_available_standards to see available standards. | |
| query | Yes | Search query for clause content (e.g., 'encryption key management', 'access control policy'). Must not be empty. | |
| limit | No | Maximum number of results to return. Default: 10. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that it returns matching clauses with text snippets, token range (~500-2000), and behavior when standard is not found (returns available IDs). It distinguishes behavior between public profiles and purchased standards, though does not explicitly state it is read-only or mention auth/rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences, each adding value. Front-loaded with purpose, then explains distinctions, return behavior, and prerequisite. No redundant or irrelevant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 3 params and no output schema, the description covers purpose, parameter context, return format, token size, and error handling. Minor gap: pagination or how limit parameter affects results not explicitly described, but adequate overall.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3). The description adds meaningful context beyond schema: it explains the two types of standards for the 'standard' parameter, describes the return structure for 'query', and mentions the token range for output, enhancing parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches within bundled public framework profiles or purchased standards by keyword, distinguishing between two content types. It specifies it returns matching clauses with text snippets and describes fallback behavior, differentiating from sibling tools like search_controls or get_clause.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises using list_available_standards before calling, providing a clear prerequisite. It implies usage context by explaining what it searches (public vs purchased) and what it returns, but does not explicitly exclude cases or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_controlsA
Full-text search across all 1,451 SCF controls by keyword in name or description. Returns matching controls with text snippets and their top framework mappings. Use this to discover controls by topic (e.g., 'encryption', 'incident response', 'access control'). Optionally filter to controls that map to specific frameworks. Returns 'No controls found' when no matches exist. Each result is ~100 tokens; default limit of 10 returns ~1000 tokens.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Search keyword or phrase. Matches against control names and descriptions. Examples: 'encryption', 'access control', 'incident response', 'data classification'. Must not be empty. | |
| frameworks | No | Optional: filter results to controls that map to these framework keys (e.g., ['iso_27001_2022', 'nist_csf_2.0']). Use list_frameworks to discover valid keys. | |
| limit | No | Maximum number of results to return. Default: 10. Use lower values to save tokens. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. Discloses return format (text snippets, top framework mappings), token size per result, default limit and total tokens, and 'No controls found' response. Informs token economy. Doesn't discuss rate limits or authentication, but acceptable for a search tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four well-structured sentences, front-loaded with core functionality. Information dense without unnecessary words. Every sentence serves a purpose: action, return, use case, token estimate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple search with one required param. Description covers search scope, return content, filtering, error case, and token budget. Missing details on pagination or query syntax (exact phrase, case sensitivity), but adequate for typical agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%. Adds value with examples for query, explanation of frameworks parameter referencing list_frameworks, and clarification of limit's token-saving purpose. Goes beyond schema by providing usage hints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs full-text search across all SCF controls by keyword, returning matching controls with snippets and framework mappings. It distinguishes from sibling tools like get_control (single control retrieval) and get_framework_controls (list by framework).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit use case: 'discover controls by topic' with examples. Mentions optional filtering to specific frameworks and suggests using list_frameworks for valid keys. Lacks explicit 'when not to use' or direct comparison to alternatives, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
version_infoA
Get server version, control/framework counts, and top 10 frameworks by coverage. Use this as a quick overview of what data is available. For structured provenance metadata, use the 'about' tool instead. Returns ~500 tokens.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It mentions the return size (~500 tokens) and that it's a quick overview. Could add error conditions or auth requirements, but for a simple read-only tool this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise with two sentences that front-load the purpose, usage recommendation, and return size. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters and no output schema, the description fully covers what the tool does, what it returns, and how it relates to a sibling tool. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. The description adds value by specifying the type of data returned, which is beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves server version, control/framework counts, and top 10 frameworks by coverage. It distinguishes itself from the sibling 'about' tool by specifying it provides a quick overview.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises to use this tool for a quick overview of available data, and recommends the 'about' tool for structured provenance metadata, providing clear when-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose: metadata (about, version_info), control retrieval/search/history/diff (get_control, search_controls, get_control_history, diff_control), framework operations (list_frameworks, get_framework_controls, get_framework_changes, map_frameworks), and standard clause access (get_clause, query_standard, list_available_standards, get_provision). No overlapping functions.
Tool names follow a consistent pattern: verb_noun with verbs like get, list, search, map, diff, query. All use snake_case, and the pattern is predictable (e.g., get_control, list_frameworks, map_frameworks). Even special tools like about and version_info are conventional.
14 tools is well-scoped for a security controls server. It covers metadata, version, controls CRUD (read/search/history/diff), standard querying, framework listing, mapping, and gap analysis without excess or deficiency.
The tool surface is comprehensive for the domain: discovery (list, search), retrieval (get), comparison (diff), mapping, and gap analysis. Missing write operations are appropriate for a read-only reference server. No obvious gaps that would hinder agent tasks.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
EU compliance corpus across 8 frameworks (NIS2, DORA, AI Act, ISO 27001 + more) via MCP.
10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).
BC/DR & compliance tools: DORA, NIS2, NIST CSF, GDPR, SOC 2, CMMC, CAF, ISO 27001, FCA/PRA.
Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables automated review and analysis of network security controls (AWS Security Groups, Network ACLs) using natural language queries. Supports NSC configuration reviews, network segmentation testing, and identifying security gaps through conversational LLM interaction.MIT
- AlicenseAqualityDmaintenanceProvides instant access to authoritative security documentation from organizations like OWASP, NIST, and major cloud providers through natural language semantic search. It enables users to retrieve security best practices, frameworks, and vulnerability information directly from a locally cached knowledge base.41MIT
- FlicenseAqualityDmaintenanceEnables users to search and monitor European regulatory publications including GDPR, ISO27001, and AI Act. Supports creating monitoring topics, generating compliance briefs, and setting up notifications for regulatory updates.5
- FlicenseNot gradedqualityDmaintenanceFree hosted MCP server for EU compliance, enabling search across 8 frameworks, cross-framework mapping, policy generation, and gap assessment via natural language.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Ansvar-Systems/security-controls-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server