Skip to main content
Glama

FedRAMP Rules MCP Server

An MCP server that answers questions about the FedRAMP Consolidated Rules for 2026. It bundles the official markdown corpus from fedramp/2026-markdown and exposes it to LLM agents through search and retrieval tools, so answers come from the authoritative source text — with citations to file paths and rule IDs.

The content is vendored at a pinned commit (see scripts/sync_content.py), so the server works offline, responds instantly, and gives stable, reproducible answers. Re-run the sync script to update.

Tools

Tool

Description

fedramp_search

BM25 full-text search across the whole corpus. Optional section prefix filter; returns ranked snippets with paths. Identical-content hits (the reference/ a/b/c/d tracks) are merged.

fedramp_get_document

Return the full markdown of one document by its repo-relative path.

fedramp_list_documents

Browse the corpus tree, optionally filtered to a section.

fedramp_get_rule

Retrieve a rule by ID (FRC-CSO-FCP, VDR-CSO-CVE, KSI-IAM-01, …) or a NIST control ID (AC-20, SI-4), with every location it appears. Case-insensitive.

fedramp_get_definition

Look up a defined term by name, alias, or FRD ID (FRD-SGC). Case-insensitive.

There is also a fedramp://source resource exposing the source repo, pinned commit, and sync timestamp for provenance.

Related MCP server: fedramp-docs-mcp

Install

Requires uv and Python 3.12+. The rules corpus is bundled in the package, so no clone or extra download is needed — install straight from GitHub:

uv tool install git+https://github.com/dan-fedramp/fedramp-rules-mcp

Then run the server over stdio with:

fedramp-rules-mcp

Or run it without installing (uv fetches, builds, and runs in one step):

uvx --from git+https://github.com/dan-fedramp/fedramp-rules-mcp fedramp-rules-mcp

Pin to a specific version by appending a ref, e.g. git+https://github.com/dan-fedramp/fedramp-rules-mcp@main.

Connecting a client

Claude Code

claude mcp add fedramp-rules -- uvx --from git+https://github.com/dan-fedramp/fedramp-rules-mcp fedramp-rules-mcp

Claude Desktop / other stdio clients

Add to the client's MCP server config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "fedramp-rules": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/dan-fedramp/fedramp-rules-mcp",
        "fedramp-rules-mcp"
      ]
    }
  }
}

If you installed with uv tool install, you can instead set "command": "fedramp-rules-mcp" with no args.

MCP Inspector

npx @modelcontextprotocol/inspector uvx --from git+https://github.com/dan-fedramp/fedramp-rules-mcp fedramp-rules-mcp

Development

To work on the server from a local clone:

git clone https://github.com/dan-fedramp/fedramp-rules-mcp
cd fedramp-rules-mcp
uv sync                          # install dependencies
uv run python -m pytest -q       # run the smoke tests
uv run fedramp-rules-mcp         # run the server from source

Updating the bundled rules

# vendor a specific commit or branch, then commit the result
uv run python scripts/sync_content.py --ref <commit-sha-or-branch>

How it works

  • scripts/sync_content.py downloads the repo tarball and extracts every .md file into src/fedramp_rules_mcp/content/, writing _meta.json for provenance.

  • content.py loads the corpus once, strips YAML frontmatter, and parses the two structured artifacts: the glossary in definitions.md (FRD-* terms) and the ??? abstract "<ID>" rule blocks throughout the corpus.

  • search.py builds an in-memory Okapi BM25 index (no external services); the tokenizer preserves hyphenated IDs so rule-ID queries match.

  • server.py wires the five tools with Pydantic-validated inputs and markdown/JSON output.

Notes

This is an unofficial tool built on public FedRAMP content. It is not affiliated with or endorsed by FedRAMP or the GSA. Always confirm against the official source for authoritative guidance.

Available Tools

5 tools
fedramp_get_definitionA
Read-onlyIdempotent

Look up a FedRAMP defined term by name, alias, or FRD ID.

Definitions are authoritative: when a defined term appears in a rule, the
definition is part of that rule and must be followed precisely.

Args:
    params (GetDefinitionInput):
        - term (str): a term, alias, or FRD ID (e.g. 'Significant Change',
          'adaptive changes', 'FRD-SGC'). Case-insensitive.

Returns:
    str: The definition, its ID, aliases, and related-terms group. Returns an
    actionable error with suggestions if the term is not defined.

Inputs: params (required). Returns: result

fedramp_get_documentA
Read-onlyIdempotent

Return the full markdown of one FedRAMP corpus document by its path.

Use a `path` returned by `fedramp_search` or `fedramp_list_documents`.

Args:
    params (GetDocumentInput):
        - path (str): repo-relative markdown path, e.g.
          'agencies/rules/agency-use.md'.

Returns:
    str: The document's markdown (frontmatter stripped), prefixed with its
    title and path. Returns an actionable error if the path is unknown.

Inputs: params (required). Returns: result

fedramp_get_ruleA
Read-onlyIdempotent

Retrieve a rule (or NIST control) by its ID, with every place it appears.

FedRAMP rule IDs look like 'FRC-CSO-FCP', 'VDR-CSO-CVE', 'KSI-IAM-01'; NIST
control IDs look like 'AC-20' or 'SI-4'. The same rule ID often appears in
several documents (e.g. the provider view and the `reference/` rulesets); all
occurrences are returned so you can cite the right context.

Args:
    params (GetRuleInput):
        - rule_id (str): the rule or control ID (case-insensitive).

Returns:
    str: The rule text plus its locations. Markdown by default. Returns an
    actionable error, with close ID suggestions, if the ID is unknown.

Inputs: params (required). Returns: result

fedramp_list_documentsA
Read-onlyIdempotent

List documents in the corpus, optionally filtered to a section prefix.

Useful for browsing the structure before drilling in. Sections include
'advisors', 'agencies', 'assessors', 'authority', 'providers', 'reference',
'responsibilities', plus top-level files (definitions.md, rules.md, ...).

Args:
    params (ListDocumentsInput):
        - section (Optional[str]): path-prefix filter (e.g. 'reference/controls').
        - response_format (ResponseFormat): 'markdown' (default) or 'json'.

Returns:
    str: List of {path, title}. JSON schema when response_format='json':
    {"section": str|null, "count": int,
     "documents": [{"path": str, "title": str}]}

Inputs: params (required). Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A4.4/5.0

    Scored across 5 tools

    Disambiguation5/5

    Each tool targets a distinct operation: term definition lookup, full document retrieval, rule/control lookup, document listing, and full-text search. No overlap in functionality.

    Naming Consistency5/5

    All tools use the 'fedramp_verb_noun' pattern in snake_case (e.g., fedramp_get_definition, fedramp_list_documents). No deviations or mixed conventions.

    Tool Count5/5

    Five tools cover the essential operations for a rules corpus (search, retrieve documents/rules/definitions, list documents). Well-scoped and not excessive.

    Completeness4/5

    Covers CRUD-like operations for reading (get, list, search). Missing bulk listing of all rules or definitions, but list_documents and search can compensate. Minor gap.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers