analyze_control_coverage

Analyzes NIST control families to identify FedRAMP compliance coverage, generating reports on addressed controls and mapping counts.

Instructions

Analyze which NIST control families have FedRAMP requirements. Returns a coverage report showing which control families are addressed and how many controls/mappings exist for each.

Input Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Implementation Reference

src/tools/analyze_control_coverage.ts:29-71 (handler)

The async execute function implementing the tool's core logic: fetches control mappings, groups by NIST control family (e.g., 'AC'), computes per-family and total coverage statistics (controls, mappings, sources), and returns structured report.

execute: async () => {
  const mappings = getControlMappings();

  // Group by control family (first 2 characters, e.g., AC, SC, IA)
  const familyMap = new Map<
    string,
    { controls: Set<string>; mappings: number; sources: Set<string> }
  >();

  for (const mapping of mappings) {
    const family = mapping.control.split("-")[0];
    if (!familyMap.has(family)) {
      familyMap.set(family, {
        controls: new Set(),
        mappings: 0,
        sources: new Set(),
      });
    }
    const entry = familyMap.get(family)!;
    entry.controls.add(mapping.control);
    entry.mappings++;
    entry.sources.add(mapping.source);
  }

  const families: FamilyCoverage[] = [...familyMap.entries()]
    .map(([family, data]) => ({
      family,
      controlCount: data.controls.size,
      mappingCount: data.mappings,
      controls: [...data.controls].sort(),
      sources: [...data.sources].sort(),
    }))
    .sort((a, b) => b.mappingCount - a.mappingCount);

  const totalControls = new Set(mappings.map((m) => m.control)).size;

  return {
    totalFamilies: families.length,
    totalControls,
    totalMappings: mappings.length,
    families,
  };
},

src/tools/analyze_control_coverage.ts:6-24 (schema)

Defines FamilyCoverage interface for output, empty Zod input schema (z.object({})), and ToolDefinition type with input/output shapes.

interface FamilyCoverage {
  family: string;
  controlCount: number;
  mappingCount: number;
  controls: string[];
  sources: string[];
}

const schema = z.object({});

export const analyzeControlCoverageTool: ToolDefinition<
  typeof schema,
  {
    totalFamilies: number;
    totalControls: number;
    totalMappings: number;
    families: FamilyCoverage[];
  }
> = {

src/tools/register.ts:24-53 (registration)

Registers analyzeControlCoverageTool (imported from ./analyze_control_coverage.js) in the MCP server by including it in the tools array passed to registerToolDefs.

export function registerTools(server: McpServer): void {
  registerToolDefs(server, [
    // Document discovery
    listFrmrDocumentsTool,
    getFrmrDocumentTool,
    listVersionsTool,
    // KSI tools
    listKsiTool,
    getKsiTool,
    filterByImpactTool,
    getThemeSummaryTool,
    getEvidenceExamplesTool,
    // Control mapping tools
    listControlsTool,
    getControlRequirementsTool,
    analyzeControlCoverageTool,
    // Search & lookup tools
    searchMarkdownTool,
    readMarkdownTool,
    searchDefinitionsTool,
    getRequirementByIdTool,
    // Analysis tools
    diffFrmrTool,
    grepControlsTool,
    significantChangeTool,
    // System tools
    healthCheckTool,
    updateRepositoryTool,
  ]);
}

FedRAMP Docs MCP Server