Which integrations are available for this server?

Provides comprehensive access to OWASP security frameworks, including Top 10, ASVS, WSTG, Cheat Sheets, and more, enabling security analysis, compliance mapping, and vulnerability management.

How do I use security-framework-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@security-framework-mcp find recent critical CVEs" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

security-framework-mcp

by zer0-kr

Overview Schema Related Servers Score Discussions

Python

Remote

Search and query 4,700+ security data points through a single MCP interface — NIST (1,196 SP 800-53 controls with 53A assessments and 53B baselines, CSF 2.0, PF 1.0, SP 800-37 RMF, 613 publications, CMVP, NICE, glossary, CSF↔800-53 mappings) and OWASP (Top 10, API/LLM/MCP Top 10, ASVS 5.0, WSTG, MASVS, Proactive Controls, 815+ CWEs, 559 CAPEC attack patterns, 113+ Cheat Sheets, 418+ projects) — with live NVD/CVE + CISA KEV + EPSS, PDF reading, compliance mapping, STRIDE threat modeling, and MCP security assessment.

Quick Start

pip install git+https://github.com/zer0-kr/security-framework-mcp.git

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "security": {
      "command": "security-framework-mcp"
    }
  }
}

Claude CLI (Claude Code):

claude mcp add security -- security-framework-mcp

{ "security": { "command": "security-framework-mcp" } }

First run automatically builds the local database (~15-20 seconds). Auto-refreshes weekly.

Data Sources (22 local + 3 live)

NIST (10)

Source	Records	Description
SP 800-53 Rev. 5 Controls	1,196	Security/privacy controls + 53A assessment objectives/methods + 53B baselines (LOW/MODERATE/HIGH)
CSF 2.0	225	Cybersecurity Framework (6 functions, 22 categories, 197 subcategories)
PF 1.0	92	Privacy Framework (5 functions)
SP 800-37 RMF	7 steps	Risk Management Framework (7-step process)
Publications	613	Full NIST cybersecurity publications (SP 800, FIPS, IR, CSWP)
CSF ↔ 800-53 Mappings	57	Framework cross-references
Glossary	39	Core cybersecurity terms
Synonyms	53	Security acronym expansions (MFA↔multi-factor authentication, etc.)
CMVP	15	FIPS 140 validated crypto modules
NICE Work Roles	43	Cybersecurity Workforce Framework roles

OWASP (12)

Source	Records	Description
Projects	418	Flagship/Production/Lab/Incubator projects
ASVS 5.0	345	Application Security Verification Standard
WSTG	111	Web Security Testing Guide
Top 10 2021 / API Top 10 2023 / LLM Top 10 2025 / MCP Top 10 2025	10 each	Web/API/LLM/MCP security risks + CWE mappings
Proactive Controls 2024	10	Developer defense controls
MASVS	23	Mobile Application Security Verification Standard
CWE Database	815+	Full MITRE CWE + OWASP cross-references
Cheat Sheets	113+	Security implementation guides (on-demand)
CAPEC Attack Patterns	559	MITRE CAPEC attack patterns + CWE cross-references

Live APIs

Source	Description
NVD CVE API 2.0	Real-time CVE search
CISA KEV	Known Exploited Vulnerabilities catalog
FIRST EPSS	Exploit Prediction Scoring System

Tools (41)

NIST

Tool	Description
`search_nist`	Search all 10 NIST sources
`get_nist_control`	SP 800-53 control — statement, guidance, 53A assessment, 53B baseline filter (LOW/MODERATE/HIGH), family filter
`get_nist_csf`	CSF 2.0 functions/categories/subcategories
`get_nist_pf`	PF 1.0
`get_nist_rmf`	SP 800-37 RMF steps, tasks, key documents
`get_nist_publication`	613 publications (SP 800, FIPS, IR, CSWP)
`read_publication`	Download + convert NIST PDFs to Markdown
`get_nist_mapping`	CSF 2.0 ↔ SP 800-53 bidirectional mappings
`get_nist_glossary`	Cybersecurity terms
`get_nist_cmvp`	FIPS 140 validated modules
`get_nice_roles`	NICE workforce roles

OWASP

Tool	Description
`list_projects`	Browse 418+ projects by level/type
`search_projects`	Full-text search across projects
`get_project`	Project details
`get_asvs`	ASVS 5.0 — filter by chapter, level, query
`get_wstg`	WSTG test cases — filter by category, query
`get_top10`	Top 10 2021 + CWE mappings
`get_api_top10`	API Security Top 10 2023
`get_llm_top10`	LLM Top 10 2025
`get_mcp_top10`	MCP Top 10 2025
`get_proactive_controls`	Proactive Controls 2024
`get_masvs`	MASVS mobile security
`get_cheatsheet`	113+ Cheat Sheets

Vulnerability & CWE

Tool	Description
`get_cwe`	CWE lookup + auto OWASP cross-references
`search_cve`	Live NVD search
`get_cve_detail`	Full CVE details
`search_kev`	CISA KEV — vendor/product/date/ransomware filters

Analysis & Assessment

Tool	Description
`lookup_compliance`	Reverse lookup: PCI-DSS/ISO 27001 requirement → NIST/ASVS
`triage_cve`	CVE triage with EPSS + CVSS + KEV composite scoring
`map_finding`	CWE/CVE → complete remediation chain
`get_attack_pattern`	CAPEC attack patterns with CWE cross-references
`search_owasp`	Search all 22 sources (NIST + OWASP unified)
`cross_reference`	CWE → Top 10 / ASVS / WSTG
`compliance_map`	ASVS → PCI-DSS 4.0 / ISO 27001:2022 / NIST 800-53
`nist_compliance_map`	SP 800-53 families → PCI-DSS 4.0 / ISO 27001:2022
`assess_stack`	Tech stack security assessment
`generate_checklist`	Security checklist (web/api/mobile/llm/full × basic/standard/comprehensive)
`assess_mcp_security`	MCP Top 10 assessment
`threat_model`	STRIDE threat modeling
`update_database`	Rebuild index
`database_status`	DB status

Prompts (4)

Prompt	Description
`security_review`	Guided security review
`threat_analysis`	Threat analysis workflow
`compliance_check`	Compliance assessment
`secure_code_review`	Code security review

Use Cases

Vulnerability Management

> Triage CVE-2021-44228 and CVE-2023-44487 — show EPSS, CVSS, KEV status

> Show all CISA KEV entries for Microsoft added after 2025-01-01

> Show only KEV vulnerabilities with known ransomware campaign use

> What attack patterns target CWE-502 (deserialization)?

> Map CWE-79 to OWASP Top 10, ASVS requirements, WSTG tests, and remediation guidance

Compliance & Audit

> What NIST SP 800-53 controls and ASVS requirements map to PCI-DSS 8.3?

> Map ASVS V4 to PCI-DSS 4.0, ISO 27001, and NIST 800-53

> Map NIST SP 800-53 AC family to PCI-DSS and ISO 27001

> Show SP 800-53 LOW baseline controls for the IA (Identification and Authentication) family

> Show SP 800-53 AC-1 control with 53A assessment objectives

Threat Modeling & Architecture Review

> Generate a STRIDE threat model: payment API, JWT auth, PostgreSQL, Redis cache

> Assess my stack: React, Node.js, PostgreSQL, REST API, AWS Lambda

> Find CAPEC attack patterns related to SQL injection

> Search all NIST and OWASP sources for "zero trust"

Development Security

> Generate a comprehensive security checklist for a web API project

> Show OWASP Cheat Sheet for Authentication

> Cross-reference CWE-352 (CSRF) to Top 10, ASVS, and WSTG test cases

> Show ASVS V3 (Session Management) level 2 requirements

> Search NVD for critical log4j CVEs

Configuration

Variable	Default	Description
`SECURITY_MCP_DATA_DIR`	`~/.security-framework-mcp`	Database directory
`SECURITY_MCP_UPDATE_INTERVAL`	`604800` (7 days)	Refresh interval
`NVD_API_KEY`	(none)	Optional NVD API key

Architecture

┌─────────────────────────────────┐
│         MCP Client              │
│  (Claude / Cursor / OpenCode)   │
└──────────────┬──────────────────┘
               │ stdio
┌──────────────▼──────────────────┐
│   security-framework-mcp        │
│  41 tools · 4 prompts · 6 rsrc │
├──────────────┬──────────────────┤
│  SQLite FTS5 │  Live APIs       │
│  (~6.2MB)    │  NVD+KEV+EPSS   │
├──────────────┴──────────────────┤
│  NIST Collectors (10)           │
│  OWASP Collectors (12)          │
└──────────────┬──────────────────┘
               │ httpx (retry)
┌──────────────▼──────────────────┐
│  NIST OSCAL/CSRC · OWASP GitHub │
└─────────────────────────────────┘

Development

git clone https://github.com/zer0-kr/security-framework-mcp.git
cd security-framework-mcp
pip install -e ".[dev]"
python -m pytest tests/test_unit_db.py tests/test_unit_collectors.py -v
python tests/test_comprehensive.py

Contributing

Fork → 2. Branch → 3. Test (python -m pytest) → 4. PR

License

MIT

Not affiliated with OWASP Foundation or NIST. Data sourced from public repositories.

Install Server

license - permissive license

quality

maintenance

How are these scores calculated?

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Tools

View all tools

Latest Blog Posts

Lightport: Open-Sourcing Glama's AI Gateway
By punkpeye on April 27, 2026.
open source
OpenAI
Tool Definition Quality Score (TDQS)
By punkpeye on April 3, 2026.
mcp
The Hackers Who Tracked My Sleep Cycle
By punkpeye on March 26, 2026.
security

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/zer0-kr/security-framework-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server