How do I use NIST MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@NIST MCP Server Show me all Access Control family controls" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

NIST MCP Server

by tnicholson

Overview Schema Source Related Servers Discussions Admin

Python

Local

NIST MCP Server

A professional Model Context Protocol (MCP) server providing comprehensive access to NIST cybersecurity frameworks and controls. Enables AI assistants and applications to query, analyze, and manage NIST security controls through a standardized, secure interface.

🚀 Quick Start

Get started with NIST's complete control catalog in minutes:

# Install and run
git clone https://github.com/your-username/nist-mcp.git
cd nist-mcp
./scripts/install.sh
python -m nist_mcp.server

That's it! Your MCP server is now running with access to 1,196+ NIST security controls.

Related MCP server: nist-mcp

🔧 What You Can Do

Core Control Operations

Browse all NIST SP 800-53 controls (1,196 total: base controls + enhancements)
Get detailed control information with implementation guidance
Search by keywords, families, or baseline levels
Map controls to Cybersecurity Framework subcategories

Enterprise Compliance Support

CMMC 2.0 assessments across all 5 maturity levels
FedRAMP readiness for Low/Moderate/High impact systems
SP 800-171 CUI baseline for protecting sensitive information
NIST Cybersecurity Framework alignment and mapping

Advanced Analysis

Gap analysis against baseline requirements
Coverage assessments across control families
Compliance mapping to other frameworks (SOC2, ISO27001)
Risk evaluation of control implementations

📖 Installation & Setup

One-Command Setup (Recommended)

git clone https://github.com/your-username/nist-mcp.git
cd nist-mcp
./scripts/install.sh
python -m nist_mcp.server

That's it! Your NIST MCP server is now running with 1,196+ controls.

Manual Setup

# 1. Clone and install
git clone https://github.com/your-username/nist-mcp.git
cd nist-mcp
pip install -e ".[dev]"

# 2. Download NIST data
python scripts/download_nist_data.py

# 3. Start server
python -m nist_mcp.server

Prerequisites

Python 3.10+
uv package manager (optional, but recommended)

🛠️ Practical Examples

Here are real examples of how to use the NIST MCP tools:

Basic Control Lookup

"What does AC-1 say?"

// Call: get_control("AC-1")
{
  "id": "ac-1",
  "title": "Policy and Procedures",
  "class": "SP800-53",
  "family": "AC",
  "parts": [
    {
      "name": "statement",
      "prose": "The organization develops and maintains a comprehensive security policy..."
    }
  ],
  "links": [...]
}

"Show me all Access Control family controls"

// Call: get_control_family("AC")
{
  "family": "AC",
  "name": "Access Control",
  "description": "The AC family contains controls...",
  "total_controls": 57,
  "base_controls": 25,
  "enhancements": 32,
  "controls": [...]
}

Compliance Analysis

"Do we meet Moderate baseline requirements?"

// Call: gap_analysis(implemented_controls=["AC-1", "AU-1"], target_baseline="moderate")
{
  "total_required": 177,
  "implemented_count": 2,
  "missing_count": 175,
  "compliance_percentage": 1.13,
  "critical_gaps": ["Risk Assessment", "Configuration Management"],
  "next_priorities": ["AC-2", "IA-2", "AU-2"]
}

"What's our CMMC Level 2 readiness?"

// Call: cmmc_compliance_assessment(implemented_controls=["AC-1", "IA-2"], target_level=2)
{
  "current_level": 1,
  "target_level": 2,
  "achieved_domains": ["AC", "IA"],
  "missing_domains": ["CM", "CP", "IR"],
  "progress_percentage": 23.5,
  "next_steps": ["Implement CM-2", "Add CP-9 controls"]
}

Risk Assessments

"How risky is our current access control implementation?"

// Call: risk_assessment_helper(control_ids=["AC-1", "AC-2", "IA-3"])
{
  "overall_risk_score": 7.3,
  "critical_gaps": ["AC-6 (Least Privilege)", "AC-18 (Wireless Access)"],
  "recommendations": [
    "Implement multi-factor authentication (IA-3)",
    "Review access control policies (AC-1)",
    "Add session timeout controls"
  ]
}

Enterprise Framework Alignment

"Map our controls to NIST CSF functions"

// Call: get_control_mappings("AC-1")
{
  "control_id": "AC-1",
  "csf_mappings": ["PR.IP-1", "PR.IP-6"],
  "functions": ["Protect"],
  "categories": ["Identity Management"],
  "rationale": "Policy framework supports identity protection"
}

"Prepare for FedRAMP Moderate authorization"

// Call: get_baseline_controls("moderate")
{
  "baseline": "Moderate",
  "total_controls": 177,
  "required_families": {
    "AC": 12, "AU": 9, "CA": 5,
    "CM": 10, "IA": 8, "IR": 6,
    "MP": 4, "PE": 8, "PS": 3,
    "RA": 5, "SC": 45, "SI": 16,
    "SA": 6, "AT": 1, "PL": 2
  },
  "implementation_timeline": "12-18 months"
}

📚 MCP Tool Reference

Core Control Operations

list_controls() - Browse all 1,196 NIST controls
get_control("AC-1") - Get detailed control info with implementation guidance
search_controls("access", "AC", 10) - Search controls by keyword within families
get_control_family("AC") - Get complete access control family (57 total controls)

Framework & Compliance

get_baseline_controls("moderate") - NIST baselines for system categorization
cmmc_compliance_assessment(current_controls, 3) - CMMC readiness assessment
fedramp_readiness_assessment(controls, "saas") - FedRAMP cloud readiness
get_sp800171_baseline() - CUI protection baseline (DOD contractors)

Advanced Analysis

gap_analysis(implemented, "high") - Identify missing controls against baselines
analyze_control_coverage(["AC-1", "AU-1"]) - Assess control family coverage
compliance_mapping("ISO27001", controls) - Cross-framework mapping

Cybersecurity Framework

get_csf_framework() - Complete NIST CSF 2.0 with all functions
search_csf_subcategories("multi-factor") - Find relevant CSF subcategories
csf_to_controls_mapping("PR.AC-1") - Map CSF requirements to controls

Project Structure

nist-mcp/
├── src/nist_mcp/           # Main package
│   ├── server.py           # MCP server implementation
│   ├── data/               # Data loading and caching
│   │   └── loader.py       # NIST data loader
│   ├── tools/              # MCP tools (future expansion)
│   └── utils/              # Utility functions
├── data/                   # NIST data sources
│   ├── nist-sources/       # Official NIST data
│   │   ├── sp800-53/       # SP 800-53 controls and baselines
│   │   ├── sp800-171/      # SP 800-171 CUI baseline profiles
│   │   ├── cmmc/           # CMMC framework and maturity levels
│   │   ├── fedramp/        # FedRAMP framework and impact levels
│   │   ├── csf/            # Cybersecurity Framework data
│   │   └── mappings/       # Control-to-CSF mappings
│   ├── oscal-schemas/      # OSCAL JSON schemas
│   └── examples/           # Example OSCAL documents
├── scripts/                # Utility scripts
│   └── download_nist_data.py # Data download script and framework creation
├── tools/                  # Additional control tools
│   └── control_tools.py    # Control management utilities
└── tests/                  # Test suite

📋 Important Notes

Data Sources

Uses official public domain NIST data:

SP 800-53 Rev 5 (1,196 controls)
Cybersecurity Framework 2.0
OSCAL schemas for document validation

Development & Testing

uv sync --dev                    # Install dev tools
make test                       # Run full test suite
make test-security              # Security testing only
python -m nist_mcp.server       # Start server

License

MIT License (code)
Public Domain (NIST data)
Apache 2.0 (OSCAL schemas)

Support

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

NizhOAuth
com.nizh
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
Security Legal & Compliance
1
NORMA MCP Server A
io.github.kynosure-ai
EU compliance corpus across 8 frameworks (NIS2, DORA, AI Act, ISO 27001 + more) via MCP.
Legal & Compliance Security
2
AppGenie Compliance MCPOAuth
au.com.appgenie
Cited, standards-aware compliance overlay for AI assistants (ISO, NIST, FedRAMP, IRAP), over MCP.
Legal & Compliance Security
2
mcpOAuth
com.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Security Monitoring
2

Related MCP Servers

MCP Server for OSCAL
Security Government Data Documentation Access
awslabs
A
license
A
quality
F
maintenance
Provides AI assistants with specialized tools to interact with NIST's Open Security Controls Assessment Language (OSCAL) framework. It enables agents to retrieve schemas, explore models, and generate valid OSCAL documentation for security compliance automation.
Updated 3 months ago (2026-06-23 20:40 UTC)
40
53
Apache 2.0
nist-mcp
Security Government Data Documentation Access
ball2jh
A
license
A
quality
D
maintenance
Provides structured access to the full NIST cybersecurity catalog, including SP 800/1800 publications, security controls, CSF 2.0, and the NVD database. It enables AI assistants to search and retrieve cybersecurity standards, CVEs, and compliance guidance directly from a local SQLite index.
Updated 5 months ago (2026-04-25 17:49 UTC)
20
1
MIT
Control-Inventory-MCP-Server
Security Search
MiguelAngelHorta
F
license
Not graded
quality
D
maintenance
Provides search, detail lookup, and gap listing tools for a security control inventory, enabling natural language queries about control status and gaps.
Updated 4 months ago (2026-06-08 17:10 UTC)
-
Kyora IQ Compliance Controlofficial
Legal & Compliance Security Documentation Access
KyoraIQ
F
license
Not graded
quality
D
maintenance
Enables AI assistants to search and retrieve security, privacy, and AI-governance controls from multiple compliance frameworks (e.g., NIST, HIPAA, OWASP) with cross-references, providing authoritative cited control text.
Updated a month ago (2026-08-13 21:54 UTC)
-

NIST MCP Server

🚀 Quick Start

🔧 What You Can Do

Core Control Operations

Enterprise Compliance Support

Advanced Analysis

📖 Installation & Setup

One-Command Setup (Recommended)

Manual Setup

Prerequisites

🛠️ Practical Examples

Basic Control Lookup

Compliance Analysis

Risk Assessments

Enterprise Framework Alignment

📚 MCP Tool Reference

Core Control Operations

Framework & Compliance

Advanced Analysis

Cybersecurity Framework

Project Structure

📋 Important Notes

Data Sources

Development & Testing

License

Support

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

MCP Server for OSCAL

nist-mcp

Control-Inventory-MCP-Server

Kyora IQ Compliance Controlofficial