Skip to main content
Glama
ethanolivertroy

FedRAMP Docs MCP Server

get_frmr_document

Retrieve FedRAMP FRMR documents to access KSI categories, MAS requirements, and compliance content with metadata and summaries for security analysis.

Instructions

Retrieve a FRMR document with metadata, raw JSON, and summary. Use this to get KSI categories (like KSI-IAM, KSI-CNA), MAS requirements, or other FRMR content. First use list_frmr_documents to find available documents, then use this tool with the path. For KSI, use path 'FRMR.KSI.key-security-indicators.json'.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
typeNo
pathYes

Implementation Reference

  • The execute handler for the 'get_frmr_document' tool. It calls getFrmrDocument with the input type and path, then returns meta, raw_json, and summary.
    execute: async (input) => {
      const { meta, rawJson, summary } = getFrmrDocument(
        input.type as never,
        input.path,
      );
      return {
        meta,
        raw_json: rawJson,
        summary,
      };
    },
  • Zod input schema for the tool: optional 'type' enum and required 'path' string.
    const schema = z.object({
      type: z
        .enum(["KSI", "MAS", "VDR", "SCN", "FRD", "ADS"])
        .optional(),
      path: z.string(),
    });
  • The registerTools function registers getFrmrDocumentTool among other tools to the MCP server.
    export function registerTools(server: McpServer): void {
      registerToolDefs(server, [
        // Document discovery
        listFrmrDocumentsTool,
        getFrmrDocumentTool,
        listVersionsTool,
        // KSI tools
        listKsiTool,
        getKsiTool,
        filterByImpactTool,
        getThemeSummaryTool,
        getEvidenceExamplesTool,
        // Control mapping tools
        listControlsTool,
        getControlRequirementsTool,
        analyzeControlCoverageTool,
        // Search & lookup tools
        searchMarkdownTool,
        readMarkdownTool,
        searchDefinitionsTool,
        getRequirementByIdTool,
        // Analysis tools
        diffFrmrTool,
        grepControlsTool,
        significantChangeTool,
        // System tools
        healthCheckTool,
        updateRepositoryTool,
      ]);
  • Helper function getFrmrDocument that resolves the document by path, performs validation, constructs metadata and summary, and returns the structured response used by the tool handler.
    export function getFrmrDocument(
      type: FrmrDocumentType | undefined,
      path: string,
    ): { meta: FrmrDocumentMeta; rawJson: string; summary: FrmrSummary } {
      const doc = resolveFrmrDocument(path);
      if (!doc) {
        throw createError({
          code: "NOT_FOUND",
          message: `FRMR document not found at path ${path}`,
        });
      }
      if (type && doc.type !== type) {
        throw createError({
          code: "BAD_REQUEST",
          message: `Requested type ${type} does not match document type ${doc.type}`,
        });
      }
      const { rawText, topLevelKeys } = doc;
      const meta: FrmrDocumentMeta = {
        type: doc.type,
        title: doc.title,
        version: doc.version,
        published: doc.published,
        path: doc.path,
        idHint: doc.idHint,
        itemCount: doc.itemCount,
      };
      const summary: FrmrSummary = {
        countItems: doc.itemCount,
        topLevelKeys,
      };
      return { meta, rawJson: rawText, summary };
    }
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It describes what the tool returns (metadata, raw JSON, summary) and mentions KSI categories and MAS requirements as examples of content. However, it doesn't disclose important behavioral aspects like error conditions, authentication requirements, rate limits, or response format details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with three sentences that each add value: stating the tool's purpose, providing usage context, and giving a concrete example. There's no wasted text, and the most important information (what the tool does) comes first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a retrieval tool with 2 parameters, 0% schema coverage, and no output schema, the description does a good job explaining purpose and usage but lacks details about the return format, error handling, and authentication requirements. The absence of an output schema means the description should ideally explain what the response contains, which it only partially addresses.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates well by explaining the 'path' parameter's purpose and providing a concrete example ('FRMR.KSI.key-security-indicators.json'). It also mentions the 'type' parameter indirectly through the enum values (KSI, MAS, etc.) in the context of what content can be retrieved.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'retrieve' and resource 'FRMR document', specifying what content is returned (metadata, raw JSON, summary). It distinguishes from sibling tools like list_frmr_documents by indicating this is for retrieving specific documents rather than listing available ones.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool ('First use list_frmr_documents to find available documents, then use this tool with the path') and gives a specific example for KSI content. It clearly differentiates from the sibling list_frmr_documents tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ethanolivertroy/fedramp-docs-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server