Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Security & GRC MCP Server scan this code for secrets and PII"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A standalone MCP server for AI-assisted security scanning and compliance gap analysis. Scans code and text for credentials, PII, and OWASP vulnerabilities, and runs compliance gap analysis across NCA ECC/DCC/CCC/CSCC, ISO 27001, NIST CSF, and SOC 2 — entirely local, no data leaves your machine.
Tool | Parameters | Description |
|
| OWASP Top 10 vulnerability scan on source code |
|
| Detects 30+ credential patterns (API keys, tokens, private keys) |
|
| Detects PII: emails, phones, credit cards, national IDs, IBANs |
|
| Alias for |
| — | Server status and version |
Tool | Parameters | Description |
| — | Lists all supported frameworks with control counts |
|
| Look up specific controls or browse by domain |
|
| Check a single NCA ECC control against evidence text |
|
| Full gap analysis across all controls in a framework |
Supported frameworks: nca_ecc, nca_dcc, nca_ccc, nca_cscc, iso_27001, nist_csf, soc_2
scan_secrets
{
"scan_type": "secrets",
"findings_count": 1,
"findings": [{"type": "GitHub Token", "severity": "CRITICAL", "count": 1, "redacted_samples": ["ghp_Ab***xyz1"]}],
"verdict": "CRITICAL EXPOSURE — ROTATE CREDENTIALS IMMEDIATELY"
}gap_analysis (nca_ecc, with evidence)
{
"framework": "nca_ecc",
"compliance_score_pct": 64.3,
"implemented": 9,
"partial": 3,
"not_implemented": 5,
"gaps_count": 8,
"domain_summary": {"access_control": {"total": 6, "implemented": 4, ...}}
}Related MCP server: SnapBack MCP Server
Add this to your claude_desktop_config.json:
{
"mcpServers": {
"security-grc": {
"command": "docker",
"args": [
"run", "--rm", "-i",
"-e", "ALLOWED_API_KEYS=pro_your_key_here",
"-p", "8080:8080",
"security-grc-mcp"
]
}
}
}Or if running locally (without Docker):
{
"mcpServers": {
"security-grc": {
"command": "python",
"args": ["/path/to/server.py"],
"env": {
"ALLOWED_API_KEYS": "pro_your_key_here"
}
}
}
}All tool calls require your API key as the api_key parameter.
# 1. Clone or copy this directory
cp .env.example .env
# Edit .env and set your ALLOWED_API_KEYS
# 2. Install dependencies
pip install -r requirements.txt
# 3. Run
python server.py
# Or with Docker
docker build -t security-grc-mcp .
docker run --env-file .env -p 8080:8080 security-grc-mcpTier | Key prefix | Calls/day | Price |
Free |
| 100 | Free |
Pro |
| Unlimited | $29/month |
To get a Pro key or request a free key, contact: abdullahajn@gmail.com
All scanning is fully local — no code or text is sent to any external service.
GRC assessments use heuristic keyword matching. Results are a readiness checklist, not an official certification or audit opinion.
NCA framework catalogs are curated readiness subsets, not official NCA assessment registers.
Version 1.0.0 · Contact: abdullahajn@gmail.com
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
No tool schema history has been recorded yet.
This server cannot be installed
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Scan configs, files, or text for leaked secrets and obvious misconfigurations. Nothing stored.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ninoajn/security-grc-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
