Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Security & GRC MCP Server scan this code for secrets and PII"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A standalone MCP server for AI-assisted security scanning and compliance gap analysis. Scans code and text for credentials, PII, and OWASP vulnerabilities, and runs compliance gap analysis across NCA ECC/DCC/CCC/CSCC, ISO 27001, NIST CSF, and SOC 2 — entirely local, no data leaves your machine.
Tool | Parameters | Description |
|
| OWASP Top 10 vulnerability scan on source code |
|
| Detects 30+ credential patterns (API keys, tokens, private keys) |
|
| Detects PII: emails, phones, credit cards, national IDs, IBANs |
|
| Alias for |
| — | Server status and version |
Tool | Parameters | Description |
| — | Lists all supported frameworks with control counts |
|
| Look up specific controls or browse by domain |
|
| Check a single NCA ECC control against evidence text |
|
| Full gap analysis across all controls in a framework |
Supported frameworks: nca_ecc, nca_dcc, nca_ccc, nca_cscc, iso_27001, nist_csf, soc_2
scan_secrets
{
"scan_type": "secrets",
"findings_count": 1,
"findings": [{"type": "GitHub Token", "severity": "CRITICAL", "count": 1, "redacted_samples": ["ghp_Ab***xyz1"]}],
"verdict": "CRITICAL EXPOSURE — ROTATE CREDENTIALS IMMEDIATELY"
}gap_analysis (nca_ecc, with evidence)
{
"framework": "nca_ecc",
"compliance_score_pct": 64.3,
"implemented": 9,
"partial": 3,
"not_implemented": 5,
"gaps_count": 8,
"domain_summary": {"access_control": {"total": 6, "implemented": 4, ...}}
}Related MCP server: opzyai
Add this to your claude_desktop_config.json:
{
"mcpServers": {
"security-grc": {
"command": "docker",
"args": [
"run", "--rm", "-i",
"-e", "ALLOWED_API_KEYS=pro_your_key_here",
"-p", "8080:8080",
"security-grc-mcp"
]
}
}
}Or if running locally (without Docker):
{
"mcpServers": {
"security-grc": {
"command": "python",
"args": ["/path/to/server.py"],
"env": {
"ALLOWED_API_KEYS": "pro_your_key_here"
}
}
}
}All tool calls require your API key as the api_key parameter.
# 1. Clone or copy this directory
cp .env.example .env
# Edit .env and set your ALLOWED_API_KEYS
# 2. Install dependencies
pip install -r requirements.txt
# 3. Run
python server.py
# Or with Docker
docker build -t security-grc-mcp .
docker run --env-file .env -p 8080:8080 security-grc-mcpTier | Key prefix | Calls/day | Price |
Free |
| 100 | Free |
Pro |
| Unlimited | $29/month |
To get a Pro key or request a free key, contact: abdullahajn@gmail.com
All scanning is fully local — no code or text is sent to any external service.
GRC assessments use heuristic keyword matching. Results are a readiness checklist, not an official certification or audit opinion.
NCA framework catalogs are curated readiness subsets, not official NCA assessment registers.
Version 1.0.0 · Contact: abdullahajn@gmail.com
This server cannot be deployed
Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Scan configs, files, or text for leaked secrets and obvious misconfigurations. Nothing stored.
