Skip to main content
Glama
Sign In
deenesjakoruzh
@cloudcraftwithfranck/govcloud-mcp

@cloudcraftwithfranck/govcloud-mcp

by cloudcwfranck
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

@cloudcraftwithfranck/govcloud-mcp

An MCP (Model Context Protocol) server providing 22 AI-powered tools for DoD/FedRAMP cloud engineering. Built for Claude Desktop, Cursor, VS Code, and any MCP-compatible AI client.

What It Does

Stop googling NIST controls and Iron Bank image paths. This server puts government cloud engineering knowledge directly into your AI assistant — compliance analysis, architecture design, Platform One Big Bang configuration, DevSecOps pipelines, and ATO documentation.

Related MCP server: Harness MCP Server

Grounded in Official Microsoft Sources

Unlike generic AI tools, this MCP server fetches content directly from Microsoft's official repositories at runtime:

  • Azure/Enterprise-Scale — The canonical ALZ reference implementation maintained by Microsoft's Azure engineering team. Policy definitions, architecture patterns, and landing zone templates are fetched live and injected as grounding context into every relevant tool call.

  • Policy Definitions — Real Azure Policy definition names and IDs from the official Enterprise Scale repository, not from training data. Always current.

  • Architecture Patterns — CAF-aligned design principles from the source of truth. Management Group hierarchies, subscription topologies, and hub-spoke network designs reference the same patterns Azure engineers use internally.

When you ask for a landing zone design or control narrative, the response is grounded in the same repository that powers the Azure Landing Zone Accelerator — not in static training data. Responses include an attribution footer linking to the source.

Quick Start

Prerequisites

Install

npm install -g @cloudcraftwithfranck/govcloud-mcp

Or run without installing:

npx @cloudcraftwithfranck/govcloud-mcp

Configure Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "govcloud": {
      "command": "npx",
      "args": ["-y", "@cloudcraftwithfranck/govcloud-mcp"],
      "env": {
        "ANTHROPIC_API_KEY": "sk-ant-your-key-here"
      }
    }
  }
}

Configure Cursor / VS Code

Add to your MCP settings:

{
  "govcloud": {
    "command": "npx",
    "args": ["-y", "@cloudcraftwithfranck/govcloud-mcp"],
    "env": {
      "ANTHROPIC_API_KEY": "sk-ant-your-key-here"
    }
  }
}

Tools Reference

Compliance (7 tools)

Tool

Description

bicep_analyze

Analyze Bicep templates for FedRAMP/IL compliance — compliance score, control gaps, security findings

bicep_remediate

Auto-remediate Bicep compliance violations — returns fixed template with annotations

control_lookup

Full NIST 800-53 Rev 5 control details with FedRAMP baselines, Azure inheritance, eMASS starters

control_narrative

Generate eMASS-ready third-person control implementation narratives (400-800 words)

poam_generate

Build POA&M entries from compliance gaps — eMASS-formatted with milestones and severity

ato_readiness

Score ATO readiness 0-100 with 30/60/90 day remediation roadmap

oscal_fragment

Generate OSCAL 1.1.2 JSON/XML SSP fragments for eMASS machine-readable import

Architecture (4 tools)

Tool

Description

landing_zone_design

Design complete Azure government landing zones with Hub-Spoke topology, Bicep, and compliance mapping

azure_service_selector

Select the right Azure service for government workloads with GCC High availability confirmation

gcc_high_guidance

GCC High-specific configuration requirements, undocumented limitations, and production workarounds

private_endpoint_map

Generate complete private endpoint architecture with Bicep and private DNS zone configuration

Platform One (4 tools)

Tool

Description

bigbang_validate

Validate Big Bang values.yaml against DoD IL requirements — scored with violations and hardened output

bigbang_harden

Generate fully hardened Big Bang values.yaml with Iron Bank digest-pinned images

ironbank_lookup

Look up Iron Bank hardened images — registry path, digest, Cosign verification, pull secret config

addon_configurator

Generate production-ready Big Bang addon configuration for any Platform One addon

Pipeline (3 tools)

Tool

Description

pipeline_audit

Audit CI/CD pipelines for DoD DevSecOps compliance — scored with violations and hardened YAML

signing_config

Configure artifact signing with Cosign/Sigstore/DoD PKI plus Kubernetes admission enforcement

devsecops_scorecard

DoD DevSecOps maturity scorecard against the Reference Design with prioritized improvement roadmap

Documents (2 tools)

Tool

Description

ssp_section

Generate eMASS-ready SSP sections (system description, boundary, user types, interconnections, etc.)

contingency_plan

Generate NIST 800-34 compliant Contingency Plans with Azure-specific recovery procedures

Example Prompts

Compliance:

"Analyze this Bicep template for FedRAMP High compliance" (paste template)

"Write an eMASS control narrative for IA-2(12) for our AKS-based system in Azure Government"

"Generate a POA&M for these compliance findings: missing MFA enforcement, no audit logging on Key Vault, public storage endpoint"

Architecture:

"Design an IL4 landing zone for a containerized mission app with AKS, Key Vault, and Azure SQL"

"What's different about configuring AKS in GCC High vs Azure Government?"

"Generate private endpoint configuration for Key Vault, Storage, and ACR at FedRAMP High"

Platform One:

"Validate this Big Bang values.yaml for IL4 compliance" (paste values)

"Look up the Iron Bank image for nginx and give me the Cosign verification command"

"Generate hardened Big Bang addon config for Keycloak at IL4"

Pipeline:

"Audit this GitLab CI pipeline for IL4 DevSecOps compliance" (paste .gitlab-ci.yml)

"Configure Cosign keyless signing for our GitHub Actions pipeline targeting registry1.dso.mil"

Documents:

"Write the system description section of our SSP for a FedRAMP High AKS system"

"Generate a Contingency Plan for our system with RTO 4 hours, RPO 1 hour, using AKS, Key Vault, and Azure SQL"

Resources

The server also exposes these resources via the govcloud:// URI scheme:

  • govcloud://nist-800-53-rev5 — NIST 800-53 Rev 5 control catalog

  • govcloud://azure-compliance-map — Azure service → NIST control mapping with IL availability

  • govcloud://ironbank-registry — Iron Bank image catalog with registry paths

  • govcloud://fedramp-baselines — FedRAMP Low/Moderate/High and DoD IL control lists

Environment Variables

Variable

Required

Default

Description

ANTHROPIC_API_KEY

Yes

—

Anthropic API key

SITE_API_BASE

No

https://www.cloudcraftwithfranck.org

Override site API base URL

Development

git clone https://github.com/cloudcwfranck/govcloud-mcp
cd govcloud-mcp
npm install
cp .env.example .env
# Add your ANTHROPIC_API_KEY to .env
npm run build
npm start

License

MIT — see LICENSE

Built by CloudCraft with Franck — Azure government cloud engineering for the DoD community.

Available Tools

22 tools
addon_configuratorA

Generate production-ready Big Bang addon configuration values for any Platform One addon. Returns hardened values with Iron Bank images, resource limits, and IL-appropriate security settings.

Inputs: addon (required), targetLevel (required), clusterSize, existingValues.

ato_readinessA

Score a system description against FedRAMP/DoD ATO requirements. Returns readiness score, critical gaps, estimated timeline, and prioritized next actions.

Inputs: systemDescription (required), azureServices (required), targetAuthorization (required), currentMaturity (required), +1 more.

azure_service_selectorA

Select the right Azure service for a government workload requirement with compliance rationale, GCC High availability confirmation, and alternatives analysis.

Inputs: requirement (required), impactLevel (required), constraints, existingServices.

bicep_analyzeA

Analyze Azure Bicep IaC code for NIST 800-53 Rev 5 compliance coverage. Returns controls addressed, gaps, security findings, and overall FedRAMP/IL4 readiness score.

Inputs: bicepCode (required), targetLevel.

bicep_remediateA

Auto-remediate Azure Bicep code to meet FedRAMP or DoD IL compliance targets. Returns hardened Bicep with a change log mapping each modification to the NIST 800-53 control it addresses.

Inputs: bicepCode (required), targetLevel, analysisJson.

bigbang_hardenA

Generate a fully hardened Big Bang values.yaml targeting DoD IL4 or IL5 from scratch or from an existing values file. Includes Chainguard/Iron Bank digest-pinned images.

Inputs: targetLevel (required), baseValues, enabledAddons, clusterName, +1 more.

bigbang_validateA

Validate a Platform One Big Bang values.yaml against DoD IL compliance requirements. Returns compliance score, specific violations, and hardened values.

Inputs: valuesYaml (required), targetLevel, bigbangVersion.

contingency_planA

Generate a NIST 800-34 compliant Contingency Plan (CP) for an Azure government system. Covers BCP/DR procedures, RTO/RPO targets, activation criteria, recovery procedures, and test schedule.

Inputs: systemName (required), systemDescription (required), azureServices (required), impactLevel (required), +3 more.

control_lookupA

Look up any NIST 800-53 Rev 5 control and get the full requirement text, Azure implementation guidance, FedRAMP inheritance model, and a copy-ready eMASS narrative starter.

Inputs: controlId (required), azureContext.

control_narrativeA

Generate eMASS-ready control implementation narratives for any NIST 800-53 Rev 5 control given your system description. Output is AO-review quality prose.

Inputs: controlId (required), systemName (required), systemDescription (required), azureServices (required), +3 more.

devsecops_scorecardA

Generate a DoD DevSecOps maturity scorecard for a software factory or program. Scores against the DoD DevSecOps Reference Design and CNCF security best practices. Returns a scored assessment with a prioritized improvement roadmap.

Inputs: programName (required), currentCapabilities (required), targetLevel (required), softwareFactoryType.

gcc_high_guidanceA

Get Azure GCC High specific configuration requirements, limitations, and gotchas for any Azure service or scenario. Includes what works differently in GCC High vs Azure Government vs Commercial.

Inputs: service (required), scenario.

govcloud_quickstartA

Confirm the GovCloud MCP server is running correctly and get the top example prompts for every tool category — the ideal first call after installation.

Inputs: no named parameters.

ironbank_lookupA

Look up Iron Bank hardened container images for any application. Returns the correct registry1.dso.mil registry path, latest approved version, Cosign verification commands, and pull secret configuration.

Inputs: imageName (required), version.

landing_zone_designC

Design a complete Azure Landing Zone architecture for government workloads. Returns hub-spoke topology, subscription structure, network layout, security services, and Bicep scaffold.

Inputs: missionType (required), dataClassification (required), userBase (required), targetImpactLevel (required), +4 more.

landing_zone_referenceB

Generate Azure Landing Zone architecture grounded in the official Microsoft Enterprise Scale reference implementation (github.com/Azure/Enterprise-Scale). Returns Management Group hierarchy, policy assignments, hub-spoke topology, and Bicep scaffold aligned with CAF and ALZ accelerator.

Inputs: scenario (required), impactLevel (required), csp (required), missionType (required), +1 more.

oscal_fragmentA

Generate valid OSCAL SSP fragment (JSON or XML) for Azure resource configurations. Machine-readable output compatible with eMASS OSCAL import.

Inputs: resourceDescription (required), controlIds (required), format, systemId, +1 more.

pipeline_auditA

Audit a CI/CD pipeline configuration (GitLab CI, GitHub Actions, Tekton, Jenkins) for DoD DevSecOps compliance. Returns a scored audit with violations and hardened pipeline YAML.

Inputs: pipelineYaml (required), pipelineType (required), targetLevel, scanTools.

poam_generateA

Generate Plan of Action & Milestones (POA&M) entries from compliance gaps. Output is formatted for eMASS import with weakness descriptions, scheduled completion dates, and milestones.

Inputs: gaps (required), systemName (required), impactLevel (required), systemOwner, +1 more.

private_endpoint_mapC

Generate the complete private endpoint architecture required for a list of Azure services at a given FedRAMP/IL compliance level. Returns Bicep for every required private endpoint and DNS configuration.

Inputs: services (required), impactLevel (required), vnetCidr, dnsZoneSubscriptionId.

signing_configA

Generate complete artifact signing and verification configuration using Sigstore/Cosign, Notary v2, or DoD PKI. Returns pipeline integration code, Kubernetes admission webhook config, and verification commands.

Inputs: signingMethod (required), pipelineType (required), registry, enforceInCluster.

ssp_sectionA

Generate a complete System Security Plan (SSP) section in eMASS-ready format. Covers system description, boundary, user types, interconnections, laws and regulations, or any NIST 800-18 section.

Inputs: section (required), systemName (required), systemDescription (required), azureServices (required), +2 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.5/5.0

    Scored across 22 tools

    Disambiguation4/5

    Most tools have distinct purposes, such as `bicep_analyze` vs. `bicep_remediate` and `control_lookup` vs. `control_narrative`. However, `landing_zone_design` and `landing_zone_reference` are very similar, potentially causing confusion despite differing descriptions.

    Naming Consistency3/5

    Tools consistently use underscore_case, but naming patterns vary: some are verb_noun (e.g., `addon_configurator`, `bicep_analyze`), while others are noun_noun or noun_verb (e.g., `landing_zone_design`, `ssp_section`). This mixture slightly reduces predictability.

    Tool Count4/5

    With 22 tools, the server provides comprehensive coverage for government cloud compliance without being excessive. Each tool serves a specific function, though some users might find the count slightly high for initial exploration.

    Completeness4/5

    The tool set covers core workflows like Big Bang configuration, NIST control management, Azure landing zones, and DevSecOps auditing. Minor gaps exist (e.g., IAM or cost compliance), but the surface is well-rounded for the stated domain.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers