security-controls-mcp 0.2.1__tar.gz → 0.3.2__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/CHANGELOG.md +11 -0
- security_controls_mcp-0.3.2/CLAUDE.md +203 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/PKG-INFO +59 -9
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/README.md +56 -5
- security_controls_mcp-0.3.2/RELEASE_NOTES_v0.3.1.md +56 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/pyproject.toml +3 -4
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/__init__.py +1 -1
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp.egg-info/PKG-INFO +59 -9
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp.egg-info/SOURCES.txt +2 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/test_smoke.py +1 -1
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/.gitleaks.toml +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/CI-CD-PIPELINE.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/CLAUDE_CODE_SETUP.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/DEPLOYMENT_CHECKLIST.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/Dockerfile +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/INSTALL.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/LEGAL_COMPLIANCE.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/LICENSE +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/LICENSE-DATA.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/MANIFEST.in +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/PAID_STANDARDS_GUIDE.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/QUICK_START.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/SECURITY-TOOLS.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/SECURITY.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/TESTING.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/quality_test.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/scf-extract-starter.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/scf-query-tester.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/setup.cfg +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/__main__.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/cli.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/config.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/data/framework-to-scf.json +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/data/scf-controls.json +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/data_loader.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/extractors/__init__.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/extractors/pdf_extractor.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/http_server.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/legal_notice.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/providers.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/registry.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/server.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp.egg-info/dependency_links.txt +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp.egg-info/entry_points.txt +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp.egg-info/requires.txt +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp.egg-info/top_level.txt +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/test_server.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/README.md +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/__init__.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/test_content_quality.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/test_data_loader.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/test_integration.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/test_paid_standards.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/tests/test_security.py +0 -0
- {security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/verify_production_ready.py +0 -0
|
@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.3.2] - 2026-01-31
|
|
9
|
+
|
|
10
|
+
### Changed
|
|
11
|
+
- Updated package metadata to use SPDX license format (removed deprecated table format)
|
|
12
|
+
- Upgraded PyPI classifier from "Development Status :: 3 - Alpha" to "4 - Beta"
|
|
13
|
+
- Removed deprecated license classifier per Poetry best practices
|
|
14
|
+
|
|
15
|
+
### Technical
|
|
16
|
+
- Production readiness verified: 104/104 tests passing, comprehensive security audit completed
|
|
17
|
+
- No functional changes to MCP tools or data
|
|
18
|
+
|
|
8
19
|
## [0.3.0] - 2026-01-29
|
|
9
20
|
|
|
10
21
|
### Added
|
|
@@ -0,0 +1,203 @@
|
|
|
1
|
+
# Security Controls MCP - Development Guide
|
|
2
|
+
|
|
3
|
+
**Part of the Ansvar MCP Suite** → See [ANSVAR_MCP_ARCHITECTURE.md](./docs/ANSVAR_MCP_ARCHITECTURE.md) for complete suite documentation
|
|
4
|
+
|
|
5
|
+
## Project Overview
|
|
6
|
+
|
|
7
|
+
MCP server providing access to 1,451 security controls across 28 frameworks. Uses SCF (Secure Controls Framework) as a rosetta stone for bidirectional framework mapping.
|
|
8
|
+
|
|
9
|
+
## Key Features
|
|
10
|
+
|
|
11
|
+
- **28 Frameworks**: ISO 27001, NIST CSF, DORA, PCI DSS, SOC 2, CMMC, FedRAMP, and 21 more
|
|
12
|
+
- **1,451 Controls**: Complete control catalog with descriptions
|
|
13
|
+
- **Bidirectional Mapping**: Map any framework to any other framework
|
|
14
|
+
- **Gap Analysis**: Compare control coverage between frameworks
|
|
15
|
+
- **Official Text Import**: Support for purchased ISO/NIST standards
|
|
16
|
+
|
|
17
|
+
## Tech Stack
|
|
18
|
+
|
|
19
|
+
- **Language**: Python 3.11+
|
|
20
|
+
- **Database**: SQLite with FTS5 full-text search
|
|
21
|
+
- **Package Manager**: Poetry
|
|
22
|
+
- **Distribution**: PyPI (`pipx install security-controls-mcp`)
|
|
23
|
+
- **Data Source**: SCF Framework (Creative Commons BY 4.0)
|
|
24
|
+
|
|
25
|
+
## Quick Start
|
|
26
|
+
|
|
27
|
+
```bash
|
|
28
|
+
# Install
|
|
29
|
+
pipx install security-controls-mcp
|
|
30
|
+
|
|
31
|
+
# Verify
|
|
32
|
+
security-controls-mcp --version
|
|
33
|
+
|
|
34
|
+
# Claude Desktop config
|
|
35
|
+
{
|
|
36
|
+
"mcpServers": {
|
|
37
|
+
"security-controls": {
|
|
38
|
+
"command": "security-controls-mcp"
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
## Project Structure
|
|
45
|
+
|
|
46
|
+
```
|
|
47
|
+
security-controls-mcp/
|
|
48
|
+
├── src/security_controls_mcp/
|
|
49
|
+
│ ├── server.py # MCP server entry point
|
|
50
|
+
│ ├── data/
|
|
51
|
+
│ │ ├── scf-controls.json # 1,451 controls with mappings
|
|
52
|
+
│ │ └── framework-to-scf.json # Framework → SCF mappings
|
|
53
|
+
│ ├── data_loader.py # SCF data loading logic
|
|
54
|
+
│ └── tools/ # MCP tool implementations
|
|
55
|
+
│ ├── version_info.py
|
|
56
|
+
│ ├── list_frameworks.py
|
|
57
|
+
│ ├── get_control.py
|
|
58
|
+
│ ├── search_controls.py
|
|
59
|
+
│ ├── get_framework_controls.py
|
|
60
|
+
│ └── map_frameworks.py
|
|
61
|
+
├── tests/ # Comprehensive test suite
|
|
62
|
+
├── docs/
|
|
63
|
+
│ ├── ANSVAR_MCP_ARCHITECTURE.md # **Central architecture doc**
|
|
64
|
+
│ └── coverage.md # Framework coverage details
|
|
65
|
+
└── pyproject.toml # Poetry configuration
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
## Available Tools
|
|
69
|
+
|
|
70
|
+
### 1. `version_info`
|
|
71
|
+
Get MCP server version and statistics
|
|
72
|
+
|
|
73
|
+
### 2. `list_frameworks`
|
|
74
|
+
List all 28 supported frameworks with control counts
|
|
75
|
+
|
|
76
|
+
### 3. `get_control`
|
|
77
|
+
Retrieve a specific control by ID from any framework
|
|
78
|
+
|
|
79
|
+
### 4. `search_controls`
|
|
80
|
+
Full-text search across all controls
|
|
81
|
+
|
|
82
|
+
### 5. `get_framework_controls`
|
|
83
|
+
Get all controls for a specific framework
|
|
84
|
+
|
|
85
|
+
### 6. `map_frameworks`
|
|
86
|
+
Map controls between any two frameworks (bidirectional)
|
|
87
|
+
|
|
88
|
+
## Framework IDs
|
|
89
|
+
|
|
90
|
+
```python
|
|
91
|
+
# Use these IDs with the tools
|
|
92
|
+
FRAMEWORKS = [
|
|
93
|
+
"iso_27001_2022", "iso_27002_2022", "nist_csf_2_0",
|
|
94
|
+
"nist_800_53_r5", "dora", "pci_dss_4_0", "soc_2",
|
|
95
|
+
"cmmc_2_0", "fedramp_high", "cis_controls_v8",
|
|
96
|
+
# ... 18 more (see docs/coverage.md)
|
|
97
|
+
]
|
|
98
|
+
```
|
|
99
|
+
|
|
100
|
+
## Development
|
|
101
|
+
|
|
102
|
+
```bash
|
|
103
|
+
# Clone and install
|
|
104
|
+
git clone https://github.com/Ansvar-Systems/security-controls-mcp
|
|
105
|
+
cd security-controls-mcp
|
|
106
|
+
poetry install
|
|
107
|
+
|
|
108
|
+
# Run tests
|
|
109
|
+
poetry run pytest
|
|
110
|
+
|
|
111
|
+
# Run locally
|
|
112
|
+
poetry run python -m src.security_controls_mcp.server
|
|
113
|
+
|
|
114
|
+
# Build for PyPI
|
|
115
|
+
poetry build
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
## Data Updates
|
|
119
|
+
|
|
120
|
+
### SCF Framework Updates
|
|
121
|
+
|
|
122
|
+
When SCF releases new versions:
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
# 1. Download new scf-controls.json from SCF repo
|
|
126
|
+
# 2. Update src/security_controls_mcp/data/scf-controls.json
|
|
127
|
+
# 3. Run tests to validate
|
|
128
|
+
poetry run pytest
|
|
129
|
+
|
|
130
|
+
# 4. Update version
|
|
131
|
+
poetry version patch
|
|
132
|
+
|
|
133
|
+
# 5. Build and publish
|
|
134
|
+
poetry build
|
|
135
|
+
poetry publish
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
### Adding New Frameworks
|
|
139
|
+
|
|
140
|
+
1. Check if SCF includes the framework
|
|
141
|
+
2. If yes, it's automatically available (SCF is the mapper)
|
|
142
|
+
3. If no, request SCF team add it OR create manual mapping in `framework-to-scf.json`
|
|
143
|
+
|
|
144
|
+
## Testing
|
|
145
|
+
|
|
146
|
+
```bash
|
|
147
|
+
# Run all tests
|
|
148
|
+
poetry run pytest
|
|
149
|
+
|
|
150
|
+
# With coverage
|
|
151
|
+
poetry run pytest --cov=src --cov-report=html
|
|
152
|
+
|
|
153
|
+
# Specific test
|
|
154
|
+
poetry run pytest tests/test_map_frameworks.py -v
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
## Current Statistics
|
|
158
|
+
|
|
159
|
+
- **Frameworks**: 28 (expanded from 16 in v0.2.1)
|
|
160
|
+
- **Controls**: 1,451 unique controls
|
|
161
|
+
- **Mappings**: 15,000+ bidirectional relationships
|
|
162
|
+
- **Database Size**: ~8MB (SQLite)
|
|
163
|
+
- **Tests**: 100% passing
|
|
164
|
+
|
|
165
|
+
## Version History
|
|
166
|
+
|
|
167
|
+
- **v0.2.1** (2026-01-29): Framework expansion (16→28 frameworks)
|
|
168
|
+
- **v0.2.0**: Initial public release with 16 frameworks
|
|
169
|
+
- **v0.1.0**: Internal beta
|
|
170
|
+
|
|
171
|
+
## Integration with Other Ansvar MCPs
|
|
172
|
+
|
|
173
|
+
This server works seamlessly with:
|
|
174
|
+
- **EU Regulations MCP**: Map DORA/GDPR requirements to ISO 27001
|
|
175
|
+
- **US Regulations MCP**: Map HIPAA/SOX to NIST controls
|
|
176
|
+
- **OT Security MCP**: Bridge IT security controls to OT standards
|
|
177
|
+
- **Sanctions MCP**: Security controls for vendor assessments
|
|
178
|
+
|
|
179
|
+
See [ANSVAR_MCP_ARCHITECTURE.md](./docs/ANSVAR_MCP_ARCHITECTURE.md) for complete workflow examples.
|
|
180
|
+
|
|
181
|
+
## Coding Guidelines
|
|
182
|
+
|
|
183
|
+
- Python 3.11+ with type hints
|
|
184
|
+
- Pydantic for data validation
|
|
185
|
+
- SQLite for data storage
|
|
186
|
+
- Black for formatting
|
|
187
|
+
- Ruff for linting
|
|
188
|
+
- pytest for testing
|
|
189
|
+
|
|
190
|
+
## Support
|
|
191
|
+
|
|
192
|
+
- **GitHub Issues**: Bug reports and feature requests
|
|
193
|
+
- **GitHub Discussions**: Questions and use cases
|
|
194
|
+
- **Commercial**: hello@ansvar.eu
|
|
195
|
+
|
|
196
|
+
## License
|
|
197
|
+
|
|
198
|
+
Apache License 2.0 - See [LICENSE](./LICENSE)
|
|
199
|
+
|
|
200
|
+
---
|
|
201
|
+
|
|
202
|
+
**For complete Ansvar MCP suite documentation, see:**
|
|
203
|
+
📖 [docs/ANSVAR_MCP_ARCHITECTURE.md](./docs/ANSVAR_MCP_ARCHITECTURE.md)
|
|
@@ -1,16 +1,15 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: security-controls-mcp
|
|
3
|
-
Version: 0.2
|
|
3
|
+
Version: 0.3.2
|
|
4
4
|
Summary: MCP server for querying security framework controls (SCF) - map between ISO 27001, NIST CSF, DORA, PCI DSS, and more
|
|
5
5
|
Author-email: Ansvar Systems <hello@ansvar.eu>
|
|
6
|
-
License: Apache-2.0
|
|
6
|
+
License-Expression: Apache-2.0
|
|
7
7
|
Project-URL: Homepage, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
8
8
|
Project-URL: Repository, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
9
9
|
Project-URL: Issues, https://github.com/Ansvar-Systems/security-controls-mcp/issues
|
|
10
10
|
Keywords: mcp,security,compliance,iso27001,nist,dora,pci-dss
|
|
11
|
-
Classifier: Development Status ::
|
|
11
|
+
Classifier: Development Status :: 4 - Beta
|
|
12
12
|
Classifier: Intended Audience :: Developers
|
|
13
|
-
Classifier: License :: OSI Approved :: Apache Software License
|
|
14
13
|
Classifier: Programming Language :: Python :: 3
|
|
15
14
|
Classifier: Programming Language :: Python :: 3.10
|
|
16
15
|
Classifier: Programming Language :: Python :: 3.11
|
|
@@ -62,9 +61,6 @@ Built on the [Secure Controls Framework (SCF)](https://securecontrolsframework.c
|
|
|
62
61
|
- Control filtering by framework, domain, or keyword
|
|
63
62
|
- SCF control metadata including PPTDF categories and security domain weights
|
|
64
63
|
|
|
65
|
-
**Integration:**
|
|
66
|
-
- Works seamlessly with [EU Regulations MCP](https://github.com/Ansvar-Systems/eu-regulations-mcp) for complete EU compliance coverage
|
|
67
|
-
|
|
68
64
|
---
|
|
69
65
|
|
|
70
66
|
## Why This Exists
|
|
@@ -73,8 +69,6 @@ When you're implementing security controls, you face a common problem: different
|
|
|
73
69
|
|
|
74
70
|
This MCP server solves that by giving you instant **bidirectional mapping** between any two frameworks via the SCF rosetta stone. Ask Claude "What DORA controls does ISO 27001 A.5.15 map to?" and get an immediate, authoritative answer backed by ComplianceForge's comprehensive framework database.
|
|
75
71
|
|
|
76
|
-
**Works with:** [EU Regulations MCP](https://github.com/Ansvar-Systems/eu-regulations-mcp) for complete EU compliance coverage (DORA + NIS2 + AI Act + GDPR + more).
|
|
77
|
-
|
|
78
72
|
---
|
|
79
73
|
|
|
80
74
|
## 🔒 Add Your Purchased Standards (Optional)
|
|
@@ -456,6 +450,62 @@ Based on **SCF 2025.4** released December 29, 2025.
|
|
|
456
450
|
|
|
457
451
|
---
|
|
458
452
|
|
|
453
|
+
## Related Projects: Complete Compliance Suite
|
|
454
|
+
|
|
455
|
+
This server is part of **Ansvar's Compliance Suite** - three MCP servers that work together for end-to-end compliance coverage:
|
|
456
|
+
|
|
457
|
+
### 🇪🇺 [EU Regulations MCP](https://github.com/Ansvar-Systems/EU_compliance_MCP)
|
|
458
|
+
**Query 47 EU regulations directly from Claude**
|
|
459
|
+
- GDPR, AI Act, DORA, NIS2, MiFID II, PSD2, eIDAS, Medical Device Regulation, and 39 more
|
|
460
|
+
- Full regulatory text with article-level search
|
|
461
|
+
- Cross-regulation reference and comparison
|
|
462
|
+
- **Install:** `npx @ansvar/eu-regulations-mcp`
|
|
463
|
+
|
|
464
|
+
### 🇺🇸 [US Regulations MCP](https://github.com/Ansvar-Systems/US_Compliance_MCP)
|
|
465
|
+
**Query US federal and state compliance laws directly from Claude**
|
|
466
|
+
- HIPAA, CCPA, SOX, GLBA, FERPA, COPPA, FDA 21 CFR Part 11, and 8 more
|
|
467
|
+
- Federal and state privacy law comparison
|
|
468
|
+
- Breach notification timeline mapping
|
|
469
|
+
- **Install:** `npm install @ansvar/us-regulations-mcp`
|
|
470
|
+
|
|
471
|
+
### 🔐 Security Controls MCP (This Project)
|
|
472
|
+
**Query 1,451 security controls across 28 frameworks**
|
|
473
|
+
- ISO 27001, NIST CSF, DORA, PCI DSS, SOC 2, CMMC, FedRAMP, and 21 more
|
|
474
|
+
- Bidirectional framework mapping and gap analysis
|
|
475
|
+
- Import your purchased standards for official text
|
|
476
|
+
- **Install:** `pipx install security-controls-mcp`
|
|
477
|
+
|
|
478
|
+
### How They Work Together
|
|
479
|
+
|
|
480
|
+
**Regulations → Controls Implementation Workflow:**
|
|
481
|
+
|
|
482
|
+
```
|
|
483
|
+
1. "What DORA requirements apply to ICT risk management?"
|
|
484
|
+
→ EU Regulations MCP returns Article 6 full text
|
|
485
|
+
|
|
486
|
+
2. "What security controls satisfy DORA Article 6?"
|
|
487
|
+
→ Security Controls MCP maps to ISO 27001, NIST CSF, and SCF controls
|
|
488
|
+
|
|
489
|
+
3. "Show me ISO 27001 A.8.1 implementation details"
|
|
490
|
+
→ Security Controls MCP returns control requirements and framework mappings
|
|
491
|
+
```
|
|
492
|
+
|
|
493
|
+
**Complete compliance in one chat:**
|
|
494
|
+
- **EU/US Regulations MCPs** tell you WHAT compliance requirements you must meet
|
|
495
|
+
- **Security Controls MCP** tells you HOW to implement controls that satisfy those requirements
|
|
496
|
+
|
|
497
|
+
### Specialized: OT/ICS Security
|
|
498
|
+
|
|
499
|
+
### 🏭 [OT Security MCP](https://github.com/Ansvar-Systems/ot-security-mcp)
|
|
500
|
+
**Query IEC 62443, NIST 800-82/53, and MITRE ATT&CK for ICS**
|
|
501
|
+
- Specialized for OT/ICS environments (manufacturing, energy, critical infrastructure)
|
|
502
|
+
- Security levels, Purdue Model, zone/conduit architecture
|
|
503
|
+
- MITRE ATT&CK for ICS threat intelligence
|
|
504
|
+
- **Install:** `npm install @ansvar/ot-security-mcp`
|
|
505
|
+
- **Use case:** Industrial control systems, SCADA, PLCs, critical infrastructure
|
|
506
|
+
|
|
507
|
+
---
|
|
508
|
+
|
|
459
509
|
## Developer Information
|
|
460
510
|
|
|
461
511
|
**Built by:** [Ansvar Systems](https://ansvar.eu) (Stockholm, Sweden) — specializes in AI-accelerated threat modeling and compliance tools
|
|
@@ -28,9 +28,6 @@ Built on the [Secure Controls Framework (SCF)](https://securecontrolsframework.c
|
|
|
28
28
|
- Control filtering by framework, domain, or keyword
|
|
29
29
|
- SCF control metadata including PPTDF categories and security domain weights
|
|
30
30
|
|
|
31
|
-
**Integration:**
|
|
32
|
-
- Works seamlessly with [EU Regulations MCP](https://github.com/Ansvar-Systems/eu-regulations-mcp) for complete EU compliance coverage
|
|
33
|
-
|
|
34
31
|
---
|
|
35
32
|
|
|
36
33
|
## Why This Exists
|
|
@@ -39,8 +36,6 @@ When you're implementing security controls, you face a common problem: different
|
|
|
39
36
|
|
|
40
37
|
This MCP server solves that by giving you instant **bidirectional mapping** between any two frameworks via the SCF rosetta stone. Ask Claude "What DORA controls does ISO 27001 A.5.15 map to?" and get an immediate, authoritative answer backed by ComplianceForge's comprehensive framework database.
|
|
41
38
|
|
|
42
|
-
**Works with:** [EU Regulations MCP](https://github.com/Ansvar-Systems/eu-regulations-mcp) for complete EU compliance coverage (DORA + NIS2 + AI Act + GDPR + more).
|
|
43
|
-
|
|
44
39
|
---
|
|
45
40
|
|
|
46
41
|
## 🔒 Add Your Purchased Standards (Optional)
|
|
@@ -422,6 +417,62 @@ Based on **SCF 2025.4** released December 29, 2025.
|
|
|
422
417
|
|
|
423
418
|
---
|
|
424
419
|
|
|
420
|
+
## Related Projects: Complete Compliance Suite
|
|
421
|
+
|
|
422
|
+
This server is part of **Ansvar's Compliance Suite** - three MCP servers that work together for end-to-end compliance coverage:
|
|
423
|
+
|
|
424
|
+
### 🇪🇺 [EU Regulations MCP](https://github.com/Ansvar-Systems/EU_compliance_MCP)
|
|
425
|
+
**Query 47 EU regulations directly from Claude**
|
|
426
|
+
- GDPR, AI Act, DORA, NIS2, MiFID II, PSD2, eIDAS, Medical Device Regulation, and 39 more
|
|
427
|
+
- Full regulatory text with article-level search
|
|
428
|
+
- Cross-regulation reference and comparison
|
|
429
|
+
- **Install:** `npx @ansvar/eu-regulations-mcp`
|
|
430
|
+
|
|
431
|
+
### 🇺🇸 [US Regulations MCP](https://github.com/Ansvar-Systems/US_Compliance_MCP)
|
|
432
|
+
**Query US federal and state compliance laws directly from Claude**
|
|
433
|
+
- HIPAA, CCPA, SOX, GLBA, FERPA, COPPA, FDA 21 CFR Part 11, and 8 more
|
|
434
|
+
- Federal and state privacy law comparison
|
|
435
|
+
- Breach notification timeline mapping
|
|
436
|
+
- **Install:** `npm install @ansvar/us-regulations-mcp`
|
|
437
|
+
|
|
438
|
+
### 🔐 Security Controls MCP (This Project)
|
|
439
|
+
**Query 1,451 security controls across 28 frameworks**
|
|
440
|
+
- ISO 27001, NIST CSF, DORA, PCI DSS, SOC 2, CMMC, FedRAMP, and 21 more
|
|
441
|
+
- Bidirectional framework mapping and gap analysis
|
|
442
|
+
- Import your purchased standards for official text
|
|
443
|
+
- **Install:** `pipx install security-controls-mcp`
|
|
444
|
+
|
|
445
|
+
### How They Work Together
|
|
446
|
+
|
|
447
|
+
**Regulations → Controls Implementation Workflow:**
|
|
448
|
+
|
|
449
|
+
```
|
|
450
|
+
1. "What DORA requirements apply to ICT risk management?"
|
|
451
|
+
→ EU Regulations MCP returns Article 6 full text
|
|
452
|
+
|
|
453
|
+
2. "What security controls satisfy DORA Article 6?"
|
|
454
|
+
→ Security Controls MCP maps to ISO 27001, NIST CSF, and SCF controls
|
|
455
|
+
|
|
456
|
+
3. "Show me ISO 27001 A.8.1 implementation details"
|
|
457
|
+
→ Security Controls MCP returns control requirements and framework mappings
|
|
458
|
+
```
|
|
459
|
+
|
|
460
|
+
**Complete compliance in one chat:**
|
|
461
|
+
- **EU/US Regulations MCPs** tell you WHAT compliance requirements you must meet
|
|
462
|
+
- **Security Controls MCP** tells you HOW to implement controls that satisfy those requirements
|
|
463
|
+
|
|
464
|
+
### Specialized: OT/ICS Security
|
|
465
|
+
|
|
466
|
+
### 🏭 [OT Security MCP](https://github.com/Ansvar-Systems/ot-security-mcp)
|
|
467
|
+
**Query IEC 62443, NIST 800-82/53, and MITRE ATT&CK for ICS**
|
|
468
|
+
- Specialized for OT/ICS environments (manufacturing, energy, critical infrastructure)
|
|
469
|
+
- Security levels, Purdue Model, zone/conduit architecture
|
|
470
|
+
- MITRE ATT&CK for ICS threat intelligence
|
|
471
|
+
- **Install:** `npm install @ansvar/ot-security-mcp`
|
|
472
|
+
- **Use case:** Industrial control systems, SCADA, PLCs, critical infrastructure
|
|
473
|
+
|
|
474
|
+
---
|
|
475
|
+
|
|
425
476
|
## Developer Information
|
|
426
477
|
|
|
427
478
|
**Built by:** [Ansvar Systems](https://ansvar.eu) (Stockholm, Sweden) — specializes in AI-accelerated threat modeling and compliance tools
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# v0.3.1 - Production Readiness
|
|
2
|
+
|
|
3
|
+
## Production Readiness Improvements
|
|
4
|
+
|
|
5
|
+
This patch release improves package metadata and confirms production readiness after comprehensive testing and security audits.
|
|
6
|
+
|
|
7
|
+
### Changed
|
|
8
|
+
- ✅ **Fixed Poetry license format** - Updated to SPDX expression (removed deprecated table format)
|
|
9
|
+
- ✅ **Upgraded to Beta status** - Changed from Alpha to Beta (Development Status :: 4)
|
|
10
|
+
- ✅ **Removed deprecated license classifier** - Following Poetry best practices
|
|
11
|
+
- ✅ **Added poetry.lock** - Ensures reproducible builds
|
|
12
|
+
|
|
13
|
+
### Quality Assurance
|
|
14
|
+
- ✅ **104/104 tests passing** - Comprehensive test coverage including:
|
|
15
|
+
- 21 content quality tests
|
|
16
|
+
- 20 data loading tests
|
|
17
|
+
- 10 integration tests
|
|
18
|
+
- 27 security tests
|
|
19
|
+
- 14 smoke tests
|
|
20
|
+
- ✅ **Security audit completed** - No credentials, PII, or sensitive data exposed
|
|
21
|
+
- ✅ **Build verification** - Clean PyPI distribution (238KB wheel, 279KB source)
|
|
22
|
+
|
|
23
|
+
### Technical Details
|
|
24
|
+
- No functional changes to MCP tools or data
|
|
25
|
+
- No breaking changes to API
|
|
26
|
+
- Fully backward compatible with 0.3.0
|
|
27
|
+
|
|
28
|
+
**Full Changelog:** https://github.com/Ansvar-Systems/security-controls-mcp/blob/main/CHANGELOG.md#031---2026-01-31
|
|
29
|
+
|
|
30
|
+
---
|
|
31
|
+
|
|
32
|
+
## Installation
|
|
33
|
+
|
|
34
|
+
```bash
|
|
35
|
+
pipx install security-controls-mcp
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
Or upgrade:
|
|
39
|
+
```bash
|
|
40
|
+
pipx upgrade security-controls-mcp
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
## What's Included
|
|
44
|
+
|
|
45
|
+
- **1,451 security controls** from SCF 2025.4
|
|
46
|
+
- **28 framework mappings** (ISO 27001, NIST CSF, DORA, PCI DSS, SOC 2, CMMC, and more)
|
|
47
|
+
- **Bidirectional framework mapping** - map any framework to any other framework
|
|
48
|
+
- **Full-text search** across all control descriptions
|
|
49
|
+
- **Optional paid standards integration** - import your purchased ISO/NIST standards
|
|
50
|
+
|
|
51
|
+
## Support
|
|
52
|
+
|
|
53
|
+
- 📚 **Documentation:** [README.md](https://github.com/Ansvar-Systems/security-controls-mcp/blob/main/README.md)
|
|
54
|
+
- 🐛 **Issues:** [GitHub Issues](https://github.com/Ansvar-Systems/security-controls-mcp/issues)
|
|
55
|
+
- 💬 **Discussions:** [GitHub Discussions](https://github.com/Ansvar-Systems/security-controls-mcp/discussions)
|
|
56
|
+
- 📧 **Email:** hello@ansvar.eu
|
|
@@ -1,18 +1,17 @@
|
|
|
1
1
|
[project]
|
|
2
2
|
name = "security-controls-mcp"
|
|
3
|
-
version = "0.2
|
|
3
|
+
version = "0.3.2"
|
|
4
4
|
description = "MCP server for querying security framework controls (SCF) - map between ISO 27001, NIST CSF, DORA, PCI DSS, and more"
|
|
5
5
|
readme = "README.md"
|
|
6
6
|
requires-python = ">=3.10"
|
|
7
|
-
license =
|
|
7
|
+
license = "Apache-2.0"
|
|
8
8
|
authors = [
|
|
9
9
|
{name = "Ansvar Systems", email = "hello@ansvar.eu"}
|
|
10
10
|
]
|
|
11
11
|
keywords = ["mcp", "security", "compliance", "iso27001", "nist", "dora", "pci-dss"]
|
|
12
12
|
classifiers = [
|
|
13
|
-
"Development Status ::
|
|
13
|
+
"Development Status :: 4 - Beta",
|
|
14
14
|
"Intended Audience :: Developers",
|
|
15
|
-
"License :: OSI Approved :: Apache Software License",
|
|
16
15
|
"Programming Language :: Python :: 3",
|
|
17
16
|
"Programming Language :: Python :: 3.10",
|
|
18
17
|
"Programming Language :: Python :: 3.11",
|
|
@@ -1,16 +1,15 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: security-controls-mcp
|
|
3
|
-
Version: 0.2
|
|
3
|
+
Version: 0.3.2
|
|
4
4
|
Summary: MCP server for querying security framework controls (SCF) - map between ISO 27001, NIST CSF, DORA, PCI DSS, and more
|
|
5
5
|
Author-email: Ansvar Systems <hello@ansvar.eu>
|
|
6
|
-
License: Apache-2.0
|
|
6
|
+
License-Expression: Apache-2.0
|
|
7
7
|
Project-URL: Homepage, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
8
8
|
Project-URL: Repository, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
9
9
|
Project-URL: Issues, https://github.com/Ansvar-Systems/security-controls-mcp/issues
|
|
10
10
|
Keywords: mcp,security,compliance,iso27001,nist,dora,pci-dss
|
|
11
|
-
Classifier: Development Status ::
|
|
11
|
+
Classifier: Development Status :: 4 - Beta
|
|
12
12
|
Classifier: Intended Audience :: Developers
|
|
13
|
-
Classifier: License :: OSI Approved :: Apache Software License
|
|
14
13
|
Classifier: Programming Language :: Python :: 3
|
|
15
14
|
Classifier: Programming Language :: Python :: 3.10
|
|
16
15
|
Classifier: Programming Language :: Python :: 3.11
|
|
@@ -62,9 +61,6 @@ Built on the [Secure Controls Framework (SCF)](https://securecontrolsframework.c
|
|
|
62
61
|
- Control filtering by framework, domain, or keyword
|
|
63
62
|
- SCF control metadata including PPTDF categories and security domain weights
|
|
64
63
|
|
|
65
|
-
**Integration:**
|
|
66
|
-
- Works seamlessly with [EU Regulations MCP](https://github.com/Ansvar-Systems/eu-regulations-mcp) for complete EU compliance coverage
|
|
67
|
-
|
|
68
64
|
---
|
|
69
65
|
|
|
70
66
|
## Why This Exists
|
|
@@ -73,8 +69,6 @@ When you're implementing security controls, you face a common problem: different
|
|
|
73
69
|
|
|
74
70
|
This MCP server solves that by giving you instant **bidirectional mapping** between any two frameworks via the SCF rosetta stone. Ask Claude "What DORA controls does ISO 27001 A.5.15 map to?" and get an immediate, authoritative answer backed by ComplianceForge's comprehensive framework database.
|
|
75
71
|
|
|
76
|
-
**Works with:** [EU Regulations MCP](https://github.com/Ansvar-Systems/eu-regulations-mcp) for complete EU compliance coverage (DORA + NIS2 + AI Act + GDPR + more).
|
|
77
|
-
|
|
78
72
|
---
|
|
79
73
|
|
|
80
74
|
## 🔒 Add Your Purchased Standards (Optional)
|
|
@@ -456,6 +450,62 @@ Based on **SCF 2025.4** released December 29, 2025.
|
|
|
456
450
|
|
|
457
451
|
---
|
|
458
452
|
|
|
453
|
+
## Related Projects: Complete Compliance Suite
|
|
454
|
+
|
|
455
|
+
This server is part of **Ansvar's Compliance Suite** - three MCP servers that work together for end-to-end compliance coverage:
|
|
456
|
+
|
|
457
|
+
### 🇪🇺 [EU Regulations MCP](https://github.com/Ansvar-Systems/EU_compliance_MCP)
|
|
458
|
+
**Query 47 EU regulations directly from Claude**
|
|
459
|
+
- GDPR, AI Act, DORA, NIS2, MiFID II, PSD2, eIDAS, Medical Device Regulation, and 39 more
|
|
460
|
+
- Full regulatory text with article-level search
|
|
461
|
+
- Cross-regulation reference and comparison
|
|
462
|
+
- **Install:** `npx @ansvar/eu-regulations-mcp`
|
|
463
|
+
|
|
464
|
+
### 🇺🇸 [US Regulations MCP](https://github.com/Ansvar-Systems/US_Compliance_MCP)
|
|
465
|
+
**Query US federal and state compliance laws directly from Claude**
|
|
466
|
+
- HIPAA, CCPA, SOX, GLBA, FERPA, COPPA, FDA 21 CFR Part 11, and 8 more
|
|
467
|
+
- Federal and state privacy law comparison
|
|
468
|
+
- Breach notification timeline mapping
|
|
469
|
+
- **Install:** `npm install @ansvar/us-regulations-mcp`
|
|
470
|
+
|
|
471
|
+
### 🔐 Security Controls MCP (This Project)
|
|
472
|
+
**Query 1,451 security controls across 28 frameworks**
|
|
473
|
+
- ISO 27001, NIST CSF, DORA, PCI DSS, SOC 2, CMMC, FedRAMP, and 21 more
|
|
474
|
+
- Bidirectional framework mapping and gap analysis
|
|
475
|
+
- Import your purchased standards for official text
|
|
476
|
+
- **Install:** `pipx install security-controls-mcp`
|
|
477
|
+
|
|
478
|
+
### How They Work Together
|
|
479
|
+
|
|
480
|
+
**Regulations → Controls Implementation Workflow:**
|
|
481
|
+
|
|
482
|
+
```
|
|
483
|
+
1. "What DORA requirements apply to ICT risk management?"
|
|
484
|
+
→ EU Regulations MCP returns Article 6 full text
|
|
485
|
+
|
|
486
|
+
2. "What security controls satisfy DORA Article 6?"
|
|
487
|
+
→ Security Controls MCP maps to ISO 27001, NIST CSF, and SCF controls
|
|
488
|
+
|
|
489
|
+
3. "Show me ISO 27001 A.8.1 implementation details"
|
|
490
|
+
→ Security Controls MCP returns control requirements and framework mappings
|
|
491
|
+
```
|
|
492
|
+
|
|
493
|
+
**Complete compliance in one chat:**
|
|
494
|
+
- **EU/US Regulations MCPs** tell you WHAT compliance requirements you must meet
|
|
495
|
+
- **Security Controls MCP** tells you HOW to implement controls that satisfy those requirements
|
|
496
|
+
|
|
497
|
+
### Specialized: OT/ICS Security
|
|
498
|
+
|
|
499
|
+
### 🏭 [OT Security MCP](https://github.com/Ansvar-Systems/ot-security-mcp)
|
|
500
|
+
**Query IEC 62443, NIST 800-82/53, and MITRE ATT&CK for ICS**
|
|
501
|
+
- Specialized for OT/ICS environments (manufacturing, energy, critical infrastructure)
|
|
502
|
+
- Security levels, Purdue Model, zone/conduit architecture
|
|
503
|
+
- MITRE ATT&CK for ICS threat intelligence
|
|
504
|
+
- **Install:** `npm install @ansvar/ot-security-mcp`
|
|
505
|
+
- **Use case:** Industrial control systems, SCADA, PLCs, critical infrastructure
|
|
506
|
+
|
|
507
|
+
---
|
|
508
|
+
|
|
459
509
|
## Developer Information
|
|
460
510
|
|
|
461
511
|
**Built by:** [Ansvar Systems](https://ansvar.eu) (Stockholm, Sweden) — specializes in AI-accelerated threat modeling and compliance tools
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
.gitleaks.toml
|
|
2
2
|
CHANGELOG.md
|
|
3
3
|
CI-CD-PIPELINE.md
|
|
4
|
+
CLAUDE.md
|
|
4
5
|
CLAUDE_CODE_SETUP.md
|
|
5
6
|
DEPLOYMENT_CHECKLIST.md
|
|
6
7
|
Dockerfile
|
|
@@ -12,6 +13,7 @@ MANIFEST.in
|
|
|
12
13
|
PAID_STANDARDS_GUIDE.md
|
|
13
14
|
QUICK_START.md
|
|
14
15
|
README.md
|
|
16
|
+
RELEASE_NOTES_v0.3.1.md
|
|
15
17
|
SECURITY-TOOLS.md
|
|
16
18
|
SECURITY.md
|
|
17
19
|
TESTING.md
|
|
@@ -94,7 +94,7 @@ class TestModuleImports:
|
|
|
94
94
|
"""Can import main package."""
|
|
95
95
|
import security_controls_mcp
|
|
96
96
|
|
|
97
|
-
assert security_controls_mcp.__version__ == "0.3.
|
|
97
|
+
assert security_controls_mcp.__version__ == "0.3.2"
|
|
98
98
|
|
|
99
99
|
def test_import_server(self):
|
|
100
100
|
"""Can import server module."""
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/__main__.py
RENAMED
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/cli.py
RENAMED
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/config.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/data_loader.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/http_server.py
RENAMED
|
File without changes
|
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/providers.py
RENAMED
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/registry.py
RENAMED
|
File without changes
|
{security_controls_mcp-0.2.1 → security_controls_mcp-0.3.2}/src/security_controls_mcp/server.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|