Skip to main content
Glama
ninoajn

Security & GRC MCP Server

by ninoajn
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

Security & GRC MCP Server

A standalone MCP server for AI-assisted security scanning and compliance gap analysis. Scans code and text for credentials, PII, and OWASP vulnerabilities, and runs compliance gap analysis across NCA ECC/DCC/CCC/CSCC, ISO 27001, NIST CSF, and SOC 2 — entirely local, no data leaves your machine.

Tools

Security Scanning

Tool

Parameters

Description

scan_code

code, language?

OWASP Top 10 vulnerability scan on source code

scan_secrets

text

Detects 30+ credential patterns (API keys, tokens, private keys)

scan_pii

text

Detects PII: emails, phones, credit cards, national IDs, IBANs

scan_vulnerabilities

code, language?

Alias for scan_code

health

—

Server status and version

GRC Compliance

Tool

Parameters

Description

list_frameworks

—

Lists all supported frameworks with control counts

control_lookup

framework, control_id?, domain?

Look up specific controls or browse by domain

check_nca_ecc

control_id, evidence?

Check a single NCA ECC control against evidence text

gap_analysis

framework, current_controls?

Full gap analysis across all controls in a framework

Supported frameworks: nca_ecc, nca_dcc, nca_ccc, nca_cscc, iso_27001, nist_csf, soc_2

Example outputs

scan_secrets

{
  "scan_type": "secrets",
  "findings_count": 1,
  "findings": [{"type": "GitHub Token", "severity": "CRITICAL", "count": 1, "redacted_samples": ["ghp_Ab***xyz1"]}],
  "verdict": "CRITICAL EXPOSURE — ROTATE CREDENTIALS IMMEDIATELY"
}

gap_analysis (nca_ecc, with evidence)

{
  "framework": "nca_ecc",
  "compliance_score_pct": 64.3,
  "implemented": 9,
  "partial": 3,
  "not_implemented": 5,
  "gaps_count": 8,
  "domain_summary": {"access_control": {"total": 6, "implemented": 4, ...}}
}

Related MCP server: Risk Audit MCP

Connecting to Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "security-grc": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "ALLOWED_API_KEYS=pro_your_key_here",
        "-p", "8080:8080",
        "security-grc-mcp"
      ]
    }
  }
}

Or if running locally (without Docker):

{
  "mcpServers": {
    "security-grc": {
      "command": "python",
      "args": ["/path/to/server.py"],
      "env": {
        "ALLOWED_API_KEYS": "pro_your_key_here"
      }
    }
  }
}

All tool calls require your API key as the api_key parameter.

Setup

# 1. Clone or copy this directory
cp .env.example .env
# Edit .env and set your ALLOWED_API_KEYS

# 2. Install dependencies
pip install -r requirements.txt

# 3. Run
python server.py

# Or with Docker
docker build -t security-grc-mcp .
docker run --env-file .env -p 8080:8080 security-grc-mcp

Pricing

Tier

Key prefix

Calls/day

Price

Free

free_

100

Free

Pro

pro_

Unlimited

$29/month

To get a Pro key or request a free key, contact: abdullahajn@gmail.com

Notes

  • All scanning is fully local — no code or text is sent to any external service.

  • GRC assessments use heuristic keyword matching. Results are a readiness checklist, not an official certification or audit opinion.

  • NCA framework catalogs are curated readiness subsets, not official NCA assessment registers.

Version 1.0.0 · Contact: abdullahajn@gmail.com

This server cannot be installed

F
license - not found
-
quality - not tested
C
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ninoajn/security-grc-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server