# Security & GRC MCP Server

A standalone MCP server for AI-assisted security scanning and compliance gap analysis. Scans code and text for credentials, PII, and OWASP vulnerabilities, and runs compliance gap analysis across NCA ECC/DCC/CCC/CSCC, ISO 27001, NIST CSF, and SOC 2 — entirely local, no data leaves your machine.

---

## Tools

### Security Scanning

| Tool | Parameters | Description |
|------|-----------|-------------|
| `scan_code` | `code`, `language?` | OWASP Top 10 vulnerability scan on source code |
| `scan_secrets` | `text` | Detects 30+ credential patterns (API keys, tokens, private keys) |
| `scan_pii` | `text` | Detects PII: emails, phones, credit cards, national IDs, IBANs |
| `scan_vulnerabilities` | `code`, `language?` | Alias for `scan_code` |
| `health` | — | Server status and version |

### GRC Compliance

| Tool | Parameters | Description |
|------|-----------|-------------|
| `list_frameworks` | — | Lists all supported frameworks with control counts |
| `control_lookup` | `framework`, `control_id?`, `domain?` | Look up specific controls or browse by domain |
| `check_nca_ecc` | `control_id`, `evidence?` | Check a single NCA ECC control against evidence text |
| `gap_analysis` | `framework`, `current_controls?` | Full gap analysis across all controls in a framework |

**Supported frameworks:** `nca_ecc`, `nca_dcc`, `nca_ccc`, `nca_cscc`, `iso_27001`, `nist_csf`, `soc_2`

### Example outputs

**`scan_secrets`**
```json
{
  "scan_type": "secrets",
  "findings_count": 1,
  "findings": [{"type": "GitHub Token", "severity": "CRITICAL", "count": 1, "redacted_samples": ["ghp_Ab***xyz1"]}],
  "verdict": "CRITICAL EXPOSURE — ROTATE CREDENTIALS IMMEDIATELY"
}
```

**`gap_analysis`** (`nca_ecc`, with evidence)
```json
{
  "framework": "nca_ecc",
  "compliance_score_pct": 64.3,
  "implemented": 9,
  "partial": 3,
  "not_implemented": 5,
  "gaps_count": 8,
  "domain_summary": {"access_control": {"total": 6, "implemented": 4, ...}}
}
```

---

## Connecting to Claude Desktop

Add this to your `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "security-grc": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "ALLOWED_API_KEYS=pro_your_key_here",
        "-p", "8080:8080",
        "security-grc-mcp"
      ]
    }
  }
}
```

Or if running locally (without Docker):

```json
{
  "mcpServers": {
    "security-grc": {
      "command": "python",
      "args": ["/path/to/server.py"],
      "env": {
        "ALLOWED_API_KEYS": "pro_your_key_here"
      }
    }
  }
}
```

All tool calls require your API key as the `api_key` parameter.

---

## Setup

```bash
# 1. Clone or copy this directory
cp .env.example .env
# Edit .env and set your ALLOWED_API_KEYS

# 2. Install dependencies
pip install -r requirements.txt

# 3. Run
python server.py

# Or with Docker
docker build -t security-grc-mcp .
docker run --env-file .env -p 8080:8080 security-grc-mcp
```

---

## Pricing

| Tier | Key prefix | Calls/day | Price |
|------|-----------|-----------|-------|
| Free | `free_` | 100 | Free |
| Pro  | `pro_`  | Unlimited | $29/month |

To get a Pro key or request a free key, contact: **abdullahajn@gmail.com**

---

## Notes

- All scanning is fully local — no code or text is sent to any external service.
- GRC assessments use heuristic keyword matching. Results are a readiness checklist, not an official certification or audit opinion.
- NCA framework catalogs are curated readiness subsets, not official NCA assessment registers.

---

*Version 1.0.0 · Contact: abdullahajn@gmail.com*