FedRAMP Rules MCP Server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@FedRAMP Rules MCP Server What does rule FRC-CSO-FCP require?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
FedRAMP Rules MCP Server
An MCP server that answers questions about the
FedRAMP Consolidated Rules for 2026. It bundles the official markdown corpus
from fedramp/2026-markdown and
exposes it to LLM agents through search and retrieval tools, so answers come from
the authoritative source text — with citations to file paths and rule IDs.
The content is vendored at a pinned commit (see scripts/sync_content.py), so
the server works offline, responds instantly, and gives stable, reproducible
answers. Re-run the sync script to update.
Tools
Tool | Description |
| BM25 full-text search across the whole corpus. Optional |
| Return the full markdown of one document by its repo-relative |
| Browse the corpus tree, optionally filtered to a section. |
| Retrieve a rule by ID ( |
| Look up a defined term by name, alias, or FRD ID ( |
There is also a fedramp://source resource exposing the source repo, pinned
commit, and sync timestamp for provenance.
Related MCP server: fedramp-docs-mcp
Install
Requires uv and Python 3.12+. The rules corpus is bundled in the package, so no clone or extra download is needed — install straight from GitHub:
uv tool install git+https://github.com/dan-fedramp/fedramp-rules-mcpThen run the server over stdio with:
fedramp-rules-mcpOr run it without installing (uv fetches, builds, and runs in one step):
uvx --from git+https://github.com/dan-fedramp/fedramp-rules-mcp fedramp-rules-mcpPin to a specific version by appending a ref, e.g.
git+https://github.com/dan-fedramp/fedramp-rules-mcp@main.
Connecting a client
Claude Code
claude mcp add fedramp-rules -- uvx --from git+https://github.com/dan-fedramp/fedramp-rules-mcp fedramp-rules-mcpClaude Desktop / other stdio clients
Add to the client's MCP server config (e.g. claude_desktop_config.json):
{
"mcpServers": {
"fedramp-rules": {
"command": "uvx",
"args": [
"--from",
"git+https://github.com/dan-fedramp/fedramp-rules-mcp",
"fedramp-rules-mcp"
]
}
}
}If you installed with uv tool install, you can instead set "command": "fedramp-rules-mcp" with no args.
MCP Inspector
npx @modelcontextprotocol/inspector uvx --from git+https://github.com/dan-fedramp/fedramp-rules-mcp fedramp-rules-mcpDevelopment
To work on the server from a local clone:
git clone https://github.com/dan-fedramp/fedramp-rules-mcp
cd fedramp-rules-mcp
uv sync # install dependencies
uv run python -m pytest -q # run the smoke tests
uv run fedramp-rules-mcp # run the server from sourceUpdating the bundled rules
# vendor a specific commit or branch, then commit the result
uv run python scripts/sync_content.py --ref <commit-sha-or-branch>How it works
scripts/sync_content.pydownloads the repo tarball and extracts every.mdfile intosrc/fedramp_rules_mcp/content/, writing_meta.jsonfor provenance.content.pyloads the corpus once, strips YAML frontmatter, and parses the two structured artifacts: the glossary indefinitions.md(FRD-*terms) and the??? abstract "<ID>"rule blocks throughout the corpus.search.pybuilds an in-memory Okapi BM25 index (no external services); the tokenizer preserves hyphenated IDs so rule-ID queries match.server.pywires the five tools with Pydantic-validated inputs and markdown/JSON output.
Notes
This is an unofficial tool built on public FedRAMP content. It is not affiliated with or endorsed by FedRAMP or the GSA. Always confirm against the official source for authoritative guidance.
Available Tools
5 toolsfedramp_get_definitionARead-onlyIdempotent
Look up a FedRAMP defined term by name, alias, or FRD ID.
Definitions are authoritative: when a defined term appears in a rule, the
definition is part of that rule and must be followed precisely.
Args:
params (GetDefinitionInput):
- term (str): a term, alias, or FRD ID (e.g. 'Significant Change',
'adaptive changes', 'FRD-SGC'). Case-insensitive.
Returns:
str: The definition, its ID, aliases, and related-terms group. Returns an
actionable error with suggestions if the term is not defined.
Inputs: params (required). Returns: result
fedramp_get_documentARead-onlyIdempotent
Return the full markdown of one FedRAMP corpus document by its path.
Use a `path` returned by `fedramp_search` or `fedramp_list_documents`.
Args:
params (GetDocumentInput):
- path (str): repo-relative markdown path, e.g.
'agencies/rules/agency-use.md'.
Returns:
str: The document's markdown (frontmatter stripped), prefixed with its
title and path. Returns an actionable error if the path is unknown.
Inputs: params (required). Returns: result
fedramp_get_ruleARead-onlyIdempotent
Retrieve a rule (or NIST control) by its ID, with every place it appears.
FedRAMP rule IDs look like 'FRC-CSO-FCP', 'VDR-CSO-CVE', 'KSI-IAM-01'; NIST
control IDs look like 'AC-20' or 'SI-4'. The same rule ID often appears in
several documents (e.g. the provider view and the `reference/` rulesets); all
occurrences are returned so you can cite the right context.
Args:
params (GetRuleInput):
- rule_id (str): the rule or control ID (case-insensitive).
Returns:
str: The rule text plus its locations. Markdown by default. Returns an
actionable error, with close ID suggestions, if the ID is unknown.
Inputs: params (required). Returns: result
fedramp_list_documentsARead-onlyIdempotent
List documents in the corpus, optionally filtered to a section prefix.
Useful for browsing the structure before drilling in. Sections include
'advisors', 'agencies', 'assessors', 'authority', 'providers', 'reference',
'responsibilities', plus top-level files (definitions.md, rules.md, ...).
Args:
params (ListDocumentsInput):
- section (Optional[str]): path-prefix filter (e.g. 'reference/controls').
- response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns:
str: List of {path, title}. JSON schema when response_format='json':
{"section": str|null, "count": int,
"documents": [{"path": str, "title": str}]}
Inputs: params (required). Returns: result
fedramp_searchARead-onlyIdempotent
Full-text search across the FedRAMP Consolidated Rules for 2026 corpus.
Ranks all bundled markdown documents (rules, definitions, control guidance,
agency/assessor/advisor guidance) by BM25 relevance to the query and returns
the best matches with a snippet and the document path. Use the returned
`path` with `fedramp_get_document` to read the full text, or use
`fedramp_get_rule` / `fedramp_get_definition` for a specific ID or term.
Args:
params (SearchInput):
- query (str): keywords or a rule ID to search for.
- section (Optional[str]): path-prefix filter (e.g. 'providers/20x').
- limit (int): max results, 1-30 (default 8).
- response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns:
str: Ranked results. JSON schema when response_format='json':
{
"query": str,
"count": int,
"results": [
{"path": str, "title": str, "section": str,
"score": float, "snippet": str}
]
}
Markdown otherwise. Returns a "No matches" message if nothing is found.
Inputs: params (required). Returns: result
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 5 tools
Each tool targets a distinct operation: term definition lookup, full document retrieval, rule/control lookup, document listing, and full-text search. No overlap in functionality.
All tools use the 'fedramp_verb_noun' pattern in snake_case (e.g., fedramp_get_definition, fedramp_list_documents). No deviations or mixed conventions.
Five tools cover the essential operations for a rules corpus (search, retrieve documents/rules/definitions, list documents). Well-scoped and not excessive.
Covers CRUD-like operations for reading (get, list, search). Missing bulk listing of all rules or definitions, but list_documents and search can compensate. Minor gap.
Maintenance
Related MCP Connectors
Read-only EU AI Act (Reg. 2024/1689 as amended) answers, citing official sources
AI agent security, MCP 2026 schema & graph audits, <250ms guardrails, and compliance dossiers
Guidance for answering vendor security questionnaires. Every result carries the page it came from.
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
Related MCP Servers
- AlicenseBqualityFmaintenanceEnables querying and analysis of FedRAMP documentation, compliance requirements, and security controls through structured tools that search markdown guidance, analyze FRMR datasets, and track regulatory changes.2067 npm17MIT
- FlicenseAqualityDmaintenanceAn unofficial MCP server that exposes public FedRAMP 20x documentation as deterministic, citable lookup tools for AI assistants, with every response citing the exact upstream source.7-
- FlicenseNot gradedqualityDmaintenanceProvides search, detail lookup, and gap listing tools for a security control inventory, enabling natural language queries about control status and gaps.-

@aws/ftr-eval-mcpofficial
AlicenseNot gradedqualityCmaintenanceAutomates the AWS Foundational Technical Review (FTR) partner self-assessment by evaluating SOC 2 and WAFR reports against defined controls, returning structured PASS/FAIL decisions with reasoning.MIT No Attribution