scf_catalog_read
Read-only
Read SCF reference catalog data by method—list or get controls, domains, frameworks, assessment objectives, and evidence definitions—to look up compliance details without organization scope.
Instructions
Read the SCF reference catalog (no org): controls, one control with its objectives and evidence, domains, frameworks, assessment objectives, evidence definitions. Pick with method.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Page size (1–100, default 25) Used by: list_controls, list_assessment_objectives, list_evidence. | |
| domain | No | SCF domain code (e.g., 'GOV', 'AST', 'IAC') — obtain from scf_list_domains Used by: list_controls. | |
| method | Yes | list_controls: List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search. get_control: Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog. list_domains: List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control). get_domain: Get one SCF domain with its controls (read, no org). Deprecated controls are excluded unless include_deprecated is set; a deprecated domain still resolves, badged. list_frameworks: List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names. list_assessment_objectives: List SCF assessment objectives — the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination. list_evidence: List the SCF reference catalog's 272 evidence types (read, no org). control_mappings is the catalogue-wide mapping, not scope — see scf_get_evidence_requiring_controls. Free-text search, pagination. get_evidence: Get one catalog evidence entry (read, no org): title, description, area of focus, control_mappings — the catalogue-wide mapping, not scope. In-scope requirers: scf_get_evidence_requiring_controls. | |
| offset | No | Pagination offset — number of results to skip (default 0) Used by: list_controls, list_assessment_objectives, list_evidence. | |
| scf_id | No | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'IAC-15', 'GOV-02') Used by: get_control. | |
| search | No | Free-text filter applied to control title and description [list_controls] | Free-text filter applied to objective text [list_assessment_objectives] | Free-text filter applied to evidence title and description [list_evidence] Used by: list_controls, list_assessment_objectives, list_evidence. | |
| framework | No | Framework slug (e.g., 'nist-800-53', 'iso-27001') — obtain from scf_list_frameworks Used by: list_controls. | |
| control_id | No | Limit to one SCF control in DOMAIN-NN format (e.g., 'GOV-01', 'AST-02') Used by: list_assessment_objectives. | |
| identifier | No | Domain code or slug, e.g. 'IAC' — obtain from scf_list_domains Used by: get_domain. | |
| evidence_id | No | Catalog evidence ID, e.g. E-IAM-01 — obtain from scf_list_evidence_catalog Used by: get_evidence. | |
| include_deprecated | No | Include catalog rows deprecated by a later SCF version. Default false — the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included. [list_controls, list_domains, list_assessment_objectives, list_evidence] | Include deprecated controls (default false) [get_domain] Used by: list_controls, list_domains, get_domain, list_assessment_objectives, list_evidence. |