security-controls-mcp 0.3.1__py3-none-any.whl → 0.3.3__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- security_controls_mcp/__init__.py +1 -1
- security_controls_mcp-0.3.3.dist-info/METADATA +288 -0
- {security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/RECORD +8 -8
- security_controls_mcp-0.3.1.dist-info/METADATA +0 -556
- {security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/WHEEL +0 -0
- {security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/entry_points.txt +0 -0
- {security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/licenses/LICENSE +0 -0
- {security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/licenses/LICENSE-DATA.md +0 -0
- {security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/top_level.txt +0 -0
|
@@ -0,0 +1,288 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: security-controls-mcp
|
|
3
|
+
Version: 0.3.3
|
|
4
|
+
Summary: MCP server for querying security framework controls (SCF) - map between ISO 27001, NIST CSF, DORA, PCI DSS, and more
|
|
5
|
+
Author-email: Ansvar Systems <hello@ansvar.eu>
|
|
6
|
+
License-Expression: Apache-2.0
|
|
7
|
+
Project-URL: Homepage, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
8
|
+
Project-URL: Repository, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
9
|
+
Project-URL: Issues, https://github.com/Ansvar-Systems/security-controls-mcp/issues
|
|
10
|
+
Keywords: mcp,security,compliance,iso27001,nist,dora,pci-dss
|
|
11
|
+
Classifier: Development Status :: 4 - Beta
|
|
12
|
+
Classifier: Intended Audience :: Developers
|
|
13
|
+
Classifier: Programming Language :: Python :: 3
|
|
14
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
15
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
17
|
+
Requires-Python: >=3.10
|
|
18
|
+
Description-Content-Type: text/markdown
|
|
19
|
+
License-File: LICENSE
|
|
20
|
+
License-File: LICENSE-DATA.md
|
|
21
|
+
Requires-Dist: mcp>=0.9.0
|
|
22
|
+
Provides-Extra: dev
|
|
23
|
+
Requires-Dist: pytest>=7.0.0; extra == "dev"
|
|
24
|
+
Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
|
|
25
|
+
Requires-Dist: black>=23.0.0; extra == "dev"
|
|
26
|
+
Requires-Dist: ruff>=0.1.0; extra == "dev"
|
|
27
|
+
Requires-Dist: pre-commit>=3.0.0; extra == "dev"
|
|
28
|
+
Provides-Extra: import-tools
|
|
29
|
+
Requires-Dist: pdfplumber>=0.11.0; extra == "import-tools"
|
|
30
|
+
Requires-Dist: Pillow>=10.0.0; extra == "import-tools"
|
|
31
|
+
Requires-Dist: click>=8.0.0; extra == "import-tools"
|
|
32
|
+
Dynamic: license-file
|
|
33
|
+
|
|
34
|
+
# Security Controls MCP Server
|
|
35
|
+
|
|
36
|
+
[](https://modelcontextprotocol.io)
|
|
37
|
+
[](https://www.python.org)
|
|
38
|
+
[](LICENSE)
|
|
39
|
+
[](https://securecontrolsframework.com/)
|
|
40
|
+
|
|
41
|
+
## Overview
|
|
42
|
+
|
|
43
|
+
Universal translator for security frameworks. Makes 1,451 security controls across 28 frameworks searchable and AI-accessible through Claude, Cursor, or any MCP-compatible client.
|
|
44
|
+
|
|
45
|
+
Built on the [Secure Controls Framework (SCF)](https://securecontrolsframework.com/) by ComplianceForge.
|
|
46
|
+
|
|
47
|
+
**Key capabilities:**
|
|
48
|
+
- 1,451 security controls across governance, risk, compliance, and technical domains
|
|
49
|
+
- 28 major frameworks including ISO 27001, NIST CSF, DORA, PCI DSS, CMMC, and more
|
|
50
|
+
- Bidirectional mapping between frameworks via SCF rosetta stone
|
|
51
|
+
- Optional integration with purchased standards (ISO, NIST 800-53) for official text
|
|
52
|
+
- Full-text search across all control descriptions
|
|
53
|
+
- Natural language queries instead of framework-specific IDs
|
|
54
|
+
|
|
55
|
+
## Why This Exists
|
|
56
|
+
|
|
57
|
+
Different frameworks describe the same security measures in different ways. ISO 27001 has one control ID, NIST CSF has another, PCI DSS has yet another — but they're all talking about the same thing.
|
|
58
|
+
|
|
59
|
+
This MCP server provides instant bidirectional mapping between any two frameworks via the SCF rosetta stone. Ask Claude "What DORA controls does ISO 27001 A.5.15 map to?" and get an immediate answer backed by ComplianceForge's framework database.
|
|
60
|
+
|
|
61
|
+
## Installation
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
# Using pipx (recommended)
|
|
65
|
+
pipx install security-controls-mcp
|
|
66
|
+
|
|
67
|
+
# Using pip
|
|
68
|
+
pip install security-controls-mcp
|
|
69
|
+
|
|
70
|
+
# From source
|
|
71
|
+
git clone https://github.com/Ansvar-Systems/security-controls-mcp.git
|
|
72
|
+
cd security-controls-mcp
|
|
73
|
+
pip install -e .
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
**Requirements:** Python 3.10+
|
|
77
|
+
|
|
78
|
+
### Claude Desktop Configuration
|
|
79
|
+
|
|
80
|
+
Add to `claude_desktop_config.json`:
|
|
81
|
+
|
|
82
|
+
```json
|
|
83
|
+
{
|
|
84
|
+
"mcpServers": {
|
|
85
|
+
"security-controls": {
|
|
86
|
+
"command": "scf-mcp"
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
```
|
|
91
|
+
|
|
92
|
+
**Config location:**
|
|
93
|
+
- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
|
|
94
|
+
- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
|
|
95
|
+
|
|
96
|
+
### Cursor / VS Code
|
|
97
|
+
|
|
98
|
+
Same configuration under `"mcp.servers"` in your settings.
|
|
99
|
+
|
|
100
|
+
## Example Queries
|
|
101
|
+
|
|
102
|
+
- "What does GOV-01 require?"
|
|
103
|
+
- "Search for controls about encryption key management"
|
|
104
|
+
- "What ISO 27001 controls map to DORA?"
|
|
105
|
+
- "List all controls needed for PCI DSS compliance"
|
|
106
|
+
- "Which DORA requirements does ISO 27001 A.5.15 satisfy?"
|
|
107
|
+
- "Show me all NIST CSF 2.0 controls related to incident response"
|
|
108
|
+
|
|
109
|
+
## Available Frameworks (28)
|
|
110
|
+
|
|
111
|
+
- **US Government:** NIST 800-53 (777), NIST CSF 2.0 (253), FedRAMP (343), CMMC 2.0 (198/52)
|
|
112
|
+
- **International Standards:** ISO 27001 (51), ISO 27002 (316), CIS CSC v8.1 (234)
|
|
113
|
+
- **US Industry:** PCI DSS v4.0.1 (364), SOC 2 (412), HIPAA (136)
|
|
114
|
+
- **APAC:** Australia Essential Eight (37), Australia ISM (336), Singapore MAS TRM (214)
|
|
115
|
+
- **EU Regulations:** GDPR (42), DORA (103), NIS2 (68)
|
|
116
|
+
- **UK Standards:** NCSC CAF 4.0 (67), Cyber Essentials (26)
|
|
117
|
+
- **European National:** Netherlands (27), Norway (23), Sweden (25), Germany (18/91/239)
|
|
118
|
+
- **Financial:** SWIFT CSCF 2023 (127)
|
|
119
|
+
- **Cloud:** CSA CCM v4 (334)
|
|
120
|
+
|
|
121
|
+
## Tools
|
|
122
|
+
|
|
123
|
+
### Core Tools
|
|
124
|
+
|
|
125
|
+
**`list_frameworks()`** - List all 28 frameworks with control counts
|
|
126
|
+
|
|
127
|
+
**`get_control(control_id)`** - Get full details for a specific SCF control
|
|
128
|
+
- Returns description, domain, weight, PPTDF category, and mappings to all 28 frameworks
|
|
129
|
+
|
|
130
|
+
**`search_controls(query, frameworks=[], limit=10)`** - Search controls by keyword
|
|
131
|
+
- Optional framework filtering
|
|
132
|
+
- Full-text search across names and descriptions
|
|
133
|
+
|
|
134
|
+
**`get_framework_controls(framework)`** - Get all controls for a specific framework
|
|
135
|
+
- Returns controls organized by domain
|
|
136
|
+
|
|
137
|
+
**`map_frameworks(source_framework, target_framework, source_control=None)`** - Map between frameworks
|
|
138
|
+
- Bidirectional mapping via SCF
|
|
139
|
+
- Optional filtering to specific source control
|
|
140
|
+
|
|
141
|
+
### Purchased Standards Tools
|
|
142
|
+
|
|
143
|
+
**`list_available_standards()`** - List all available standards (SCF + imported)
|
|
144
|
+
|
|
145
|
+
**`query_standard(standard, query, limit=10)`** - Search within purchased standard
|
|
146
|
+
- Requires import first
|
|
147
|
+
- Returns clauses with page numbers
|
|
148
|
+
|
|
149
|
+
**`get_clause(standard, clause_id)`** - Get full text of specific clause
|
|
150
|
+
- Requires import first
|
|
151
|
+
|
|
152
|
+
See [PAID_STANDARDS_GUIDE.md](PAID_STANDARDS_GUIDE.md) for import instructions.
|
|
153
|
+
|
|
154
|
+
## Add Purchased Standards (Optional)
|
|
155
|
+
|
|
156
|
+
Import your purchased ISO 27001, NIST SP 800-53, or other standards to get official text alongside SCF descriptions:
|
|
157
|
+
|
|
158
|
+
```bash
|
|
159
|
+
# Install import tools
|
|
160
|
+
pip install -e '.[import-tools]'
|
|
161
|
+
|
|
162
|
+
# Import purchased PDF
|
|
163
|
+
scf-mcp import-standard \
|
|
164
|
+
--file ~/Downloads/ISO-27001-2022.pdf \
|
|
165
|
+
--type iso_27001_2022 \
|
|
166
|
+
--title "ISO/IEC 27001:2022"
|
|
167
|
+
|
|
168
|
+
# Restart MCP, then query
|
|
169
|
+
```
|
|
170
|
+
|
|
171
|
+
Your paid content stays private in `~/.security-controls-mcp/` (never committed to git).
|
|
172
|
+
|
|
173
|
+
Full guide: [PAID_STANDARDS_GUIDE.md](PAID_STANDARDS_GUIDE.md)
|
|
174
|
+
|
|
175
|
+
## Technical Architecture
|
|
176
|
+
|
|
177
|
+
**Data Pipeline:**
|
|
178
|
+
SCF JSON → In-memory index → MCP tools → AI response
|
|
179
|
+
|
|
180
|
+
**Key principles:**
|
|
181
|
+
- All control text returns verbatim from SCF source with zero LLM paraphrasing
|
|
182
|
+
- Framework mappings use ComplianceForge's authoritative crosswalks
|
|
183
|
+
- Optional purchased standards stored locally (never committed)
|
|
184
|
+
- Search results optimized for AI context windows
|
|
185
|
+
|
|
186
|
+
**Data integrity:**
|
|
187
|
+
- SCF version locked to 2025.4 for consistency
|
|
188
|
+
- All mappings sourced from official SCF framework crosswalks
|
|
189
|
+
- User-imported standards require valid licenses
|
|
190
|
+
|
|
191
|
+
## Data Source
|
|
192
|
+
|
|
193
|
+
Based on **SCF 2025.4** (released December 29, 2025)
|
|
194
|
+
|
|
195
|
+
- 1,451 controls across all domains
|
|
196
|
+
- 580+ framework mappings (28 frameworks)
|
|
197
|
+
- Licensed under Creative Commons (data)
|
|
198
|
+
- Source: [ComplianceForge SCF](https://securecontrolsframework.com/)
|
|
199
|
+
|
|
200
|
+
**Included data files:**
|
|
201
|
+
- `scf-controls.json` - All 1,451 controls with framework mappings
|
|
202
|
+
- `framework-to-scf.json` - Reverse index for framework-to-SCF lookups
|
|
203
|
+
|
|
204
|
+
## Related Projects
|
|
205
|
+
|
|
206
|
+
Part of **Ansvar's Compliance Suite** - MCP servers that work together for end-to-end compliance:
|
|
207
|
+
|
|
208
|
+
**EU Regulations MCP** - Query 47 EU regulations (GDPR, AI Act, DORA, NIS2, etc.)
|
|
209
|
+
- `npx @ansvar/eu-regulations-mcp`
|
|
210
|
+
- [github.com/Ansvar-Systems/EU_compliance_MCP](https://github.com/Ansvar-Systems/EU_compliance_MCP)
|
|
211
|
+
|
|
212
|
+
**US Regulations MCP** - Query US federal and state compliance laws (HIPAA, CCPA, SOX, etc.)
|
|
213
|
+
- `npm install @ansvar/us-regulations-mcp`
|
|
214
|
+
- [github.com/Ansvar-Systems/US_Compliance_MCP](https://github.com/Ansvar-Systems/US_Compliance_MCP)
|
|
215
|
+
|
|
216
|
+
**OT Security MCP** - Query IEC 62443, NIST 800-82/53, MITRE ATT&CK for ICS
|
|
217
|
+
- `npm install @ansvar/ot-security-mcp`
|
|
218
|
+
- [github.com/Ansvar-Systems/ot-security-mcp](https://github.com/Ansvar-Systems/ot-security-mcp)
|
|
219
|
+
|
|
220
|
+
### Workflow Example
|
|
221
|
+
|
|
222
|
+
```
|
|
223
|
+
1. "What DORA requirements apply to ICT risk management?"
|
|
224
|
+
→ EU Regulations MCP returns Article 6 full text
|
|
225
|
+
|
|
226
|
+
2. "What security controls satisfy DORA Article 6?"
|
|
227
|
+
→ Security Controls MCP maps to ISO 27001, NIST CSF controls
|
|
228
|
+
|
|
229
|
+
3. "Show me ISO 27001 A.8.1 implementation details"
|
|
230
|
+
→ Security Controls MCP returns control requirements
|
|
231
|
+
```
|
|
232
|
+
|
|
233
|
+
## Development
|
|
234
|
+
|
|
235
|
+
```bash
|
|
236
|
+
# Clone and install
|
|
237
|
+
git clone https://github.com/Ansvar-Systems/security-controls-mcp.git
|
|
238
|
+
cd security-controls-mcp
|
|
239
|
+
pip install -e '.[dev]'
|
|
240
|
+
|
|
241
|
+
# Install pre-commit hooks
|
|
242
|
+
pre-commit install
|
|
243
|
+
|
|
244
|
+
# Run tests
|
|
245
|
+
pytest tests/ -v
|
|
246
|
+
```
|
|
247
|
+
|
|
248
|
+
Pre-commit hooks run automatically before each commit:
|
|
249
|
+
- Code formatting (black, ruff)
|
|
250
|
+
- Linting (ruff check, YAML/JSON validation)
|
|
251
|
+
- Tests (pytest, smoke tests, server startup)
|
|
252
|
+
|
|
253
|
+
Bypass hooks (emergencies only): `git commit --no-verify`
|
|
254
|
+
|
|
255
|
+
## Important Disclaimers
|
|
256
|
+
|
|
257
|
+
**Not Legal or Compliance Advice:** Control text is sourced directly from official SCF data, but this tool should not be used as the sole basis for compliance decisions. Always verify against official framework sources and consult qualified compliance professionals.
|
|
258
|
+
|
|
259
|
+
**AI Content Restrictions:** The SCF license explicitly prohibits using AI systems to generate derivative content such as policies, standards, procedures, metrics, risks, or threats based on SCF data. You may query and analyze controls, but not generate derivative compliance artifacts.
|
|
260
|
+
|
|
261
|
+
**Purchased Standards:** Optional standards imports require valid licenses. You must own legitimate copies and comply with copyright restrictions. This tool does not include or distribute any copyrighted standards text.
|
|
262
|
+
|
|
263
|
+
**Framework Coverage:** While SCF provides comprehensive mappings, not all controls map 1:1 across frameworks. Always review official framework documentation for authoritative requirements.
|
|
264
|
+
|
|
265
|
+
## License
|
|
266
|
+
|
|
267
|
+
**Code:** Apache License 2.0 (see [LICENSE](LICENSE))
|
|
268
|
+
|
|
269
|
+
**Data:** Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0) by ComplianceForge
|
|
270
|
+
- Source: [Secure Controls Framework (SCF)](https://securecontrolsframework.com/)
|
|
271
|
+
- Version: SCF 2025.4 (December 29, 2025)
|
|
272
|
+
|
|
273
|
+
**What you MAY do:**
|
|
274
|
+
- Query and analyze SCF controls
|
|
275
|
+
- Map between frameworks
|
|
276
|
+
- Reference controls in your own work (with attribution)
|
|
277
|
+
- Use this MCP server to understand control requirements
|
|
278
|
+
|
|
279
|
+
**What you MAY NOT do:**
|
|
280
|
+
- Use AI to generate policies or procedures based on SCF controls
|
|
281
|
+
- Create derivative frameworks or modified versions for distribution
|
|
282
|
+
- Remove or modify control definitions
|
|
283
|
+
|
|
284
|
+
For complete terms: [SCF Terms & Conditions](https://securecontrolsframework.com/terms-conditions/)
|
|
285
|
+
|
|
286
|
+
---
|
|
287
|
+
|
|
288
|
+
**Built by:** [Ansvar Systems](https://ansvar.eu) (Stockholm, Sweden)
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
security_controls_mcp/__init__.py,sha256=
|
|
1
|
+
security_controls_mcp/__init__.py,sha256=OAVs20I9SlLR_V-yJTnibMSz08vr85J3edoDljhpG4M,108
|
|
2
2
|
security_controls_mcp/__main__.py,sha256=4qAnCoMWk197dfiYhSjKJjYWpM-ZCQEHDu6dhZmf3Co,132
|
|
3
3
|
security_controls_mcp/cli.py,sha256=7LoL0pJOVIrvfvZn7TfBb9V8sLg8UdDBn35JI5c9r3s,7540
|
|
4
4
|
security_controls_mcp/config.py,sha256=7MW9pxKf9Fc0A8D25VW9SqSJbTMWw5r7mSezX164-oQ,4996
|
|
@@ -12,10 +12,10 @@ security_controls_mcp/data/framework-to-scf.json,sha256=cR0-3b8QDJ_0NVVrCqkcxr-E
|
|
|
12
12
|
security_controls_mcp/data/scf-controls.json,sha256=U6gtDVE8z_HtHdypLn9CLkCh4ZCS0Q78fk6EwQZyq9E,2188171
|
|
13
13
|
security_controls_mcp/extractors/__init__.py,sha256=_dQ1HOD7gTyw2FwQMMtgVTYQVSpxIdwBwqsdkSo1nyE,143
|
|
14
14
|
security_controls_mcp/extractors/pdf_extractor.py,sha256=nYd8mbKn_ejeEm02VZrFColRIfYFbP_oOuUm2SfOVqc,7490
|
|
15
|
-
security_controls_mcp-0.3.
|
|
16
|
-
security_controls_mcp-0.3.
|
|
17
|
-
security_controls_mcp-0.3.
|
|
18
|
-
security_controls_mcp-0.3.
|
|
19
|
-
security_controls_mcp-0.3.
|
|
20
|
-
security_controls_mcp-0.3.
|
|
21
|
-
security_controls_mcp-0.3.
|
|
15
|
+
security_controls_mcp-0.3.3.dist-info/licenses/LICENSE,sha256=RjWhs6k8-dS1rdwUk40lp3R0kf8UVOrlASOO0FTDRnU,743
|
|
16
|
+
security_controls_mcp-0.3.3.dist-info/licenses/LICENSE-DATA.md,sha256=I7iuA6E8TQyL3SMQltKFoOO12Ew2W0D8NSEmFAL5XDw,2096
|
|
17
|
+
security_controls_mcp-0.3.3.dist-info/METADATA,sha256=PG0A-PER8NfBtfEWxd9W5t12CqP3N1eNHguo9rJs6Oc,10990
|
|
18
|
+
security_controls_mcp-0.3.3.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
|
|
19
|
+
security_controls_mcp-0.3.3.dist-info/entry_points.txt,sha256=pDgfu1FAwJGyGp2yGU4uhiLrt9Wy06uzTybWh7frYCs,59
|
|
20
|
+
security_controls_mcp-0.3.3.dist-info/top_level.txt,sha256=BEEvk-ppPSeK1_OyEy0SIpt04wnf3nUorVOFU0fEmS0,22
|
|
21
|
+
security_controls_mcp-0.3.3.dist-info/RECORD,,
|
|
@@ -1,556 +0,0 @@
|
|
|
1
|
-
Metadata-Version: 2.4
|
|
2
|
-
Name: security-controls-mcp
|
|
3
|
-
Version: 0.3.1
|
|
4
|
-
Summary: MCP server for querying security framework controls (SCF) - map between ISO 27001, NIST CSF, DORA, PCI DSS, and more
|
|
5
|
-
Author-email: Ansvar Systems <hello@ansvar.eu>
|
|
6
|
-
License-Expression: Apache-2.0
|
|
7
|
-
Project-URL: Homepage, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
8
|
-
Project-URL: Repository, https://github.com/Ansvar-Systems/security-controls-mcp
|
|
9
|
-
Project-URL: Issues, https://github.com/Ansvar-Systems/security-controls-mcp/issues
|
|
10
|
-
Keywords: mcp,security,compliance,iso27001,nist,dora,pci-dss
|
|
11
|
-
Classifier: Development Status :: 4 - Beta
|
|
12
|
-
Classifier: Intended Audience :: Developers
|
|
13
|
-
Classifier: Programming Language :: Python :: 3
|
|
14
|
-
Classifier: Programming Language :: Python :: 3.10
|
|
15
|
-
Classifier: Programming Language :: Python :: 3.11
|
|
16
|
-
Classifier: Programming Language :: Python :: 3.12
|
|
17
|
-
Requires-Python: >=3.10
|
|
18
|
-
Description-Content-Type: text/markdown
|
|
19
|
-
License-File: LICENSE
|
|
20
|
-
License-File: LICENSE-DATA.md
|
|
21
|
-
Requires-Dist: mcp>=0.9.0
|
|
22
|
-
Provides-Extra: dev
|
|
23
|
-
Requires-Dist: pytest>=7.0.0; extra == "dev"
|
|
24
|
-
Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
|
|
25
|
-
Requires-Dist: black>=23.0.0; extra == "dev"
|
|
26
|
-
Requires-Dist: ruff>=0.1.0; extra == "dev"
|
|
27
|
-
Requires-Dist: pre-commit>=3.0.0; extra == "dev"
|
|
28
|
-
Provides-Extra: import-tools
|
|
29
|
-
Requires-Dist: pdfplumber>=0.11.0; extra == "import-tools"
|
|
30
|
-
Requires-Dist: Pillow>=10.0.0; extra == "import-tools"
|
|
31
|
-
Requires-Dist: click>=8.0.0; extra == "import-tools"
|
|
32
|
-
Dynamic: license-file
|
|
33
|
-
|
|
34
|
-
# Security Controls MCP Server
|
|
35
|
-
|
|
36
|
-
[](https://modelcontextprotocol.io)
|
|
37
|
-
[](https://www.python.org)
|
|
38
|
-
[](LICENSE)
|
|
39
|
-
[](https://securecontrolsframework.com/)
|
|
40
|
-
|
|
41
|
-
## Overview
|
|
42
|
-
|
|
43
|
-
**The universal translator for security frameworks.**
|
|
44
|
-
|
|
45
|
-
The Security Controls MCP Server is an open-source tool that makes 1,451 security controls across 28 frameworks searchable and AI-accessible directly through Claude, Cursor, or any MCP-compatible client.
|
|
46
|
-
|
|
47
|
-
Built on the [Secure Controls Framework (SCF)](https://securecontrolsframework.com/) by ComplianceForge.
|
|
48
|
-
|
|
49
|
-
## Key Features
|
|
50
|
-
|
|
51
|
-
**Coverage:**
|
|
52
|
-
- 1,451 security controls spanning governance, risk, compliance, and technical domains
|
|
53
|
-
- 28 major frameworks including ISO 27001, NIST CSF, DORA, PCI DSS, CMMC, Australian Essential Eight, Singapore MAS TRM, SWIFT CSCF, and more
|
|
54
|
-
- Bidirectional mapping between any two frameworks via SCF rosetta stone
|
|
55
|
-
- Optional integration with purchased standards (ISO, NIST 800-53) for official text
|
|
56
|
-
|
|
57
|
-
**Capabilities:**
|
|
58
|
-
- Full-text search across all control descriptions and names
|
|
59
|
-
- Natural language queries instead of framework-specific control IDs
|
|
60
|
-
- Cross-framework requirement comparison (e.g., "What DORA controls does ISO 27001 A.5.15 map to?")
|
|
61
|
-
- Control filtering by framework, domain, or keyword
|
|
62
|
-
- SCF control metadata including PPTDF categories and security domain weights
|
|
63
|
-
|
|
64
|
-
---
|
|
65
|
-
|
|
66
|
-
## Why This Exists
|
|
67
|
-
|
|
68
|
-
When you're implementing security controls, you face a common problem: different frameworks describe the same security measures in different ways. ISO 27001 has one control ID, NIST CSF has another, PCI DSS has yet another — but they're all talking about the same thing.
|
|
69
|
-
|
|
70
|
-
This MCP server solves that by giving you instant **bidirectional mapping** between any two frameworks via the SCF rosetta stone. Ask Claude "What DORA controls does ISO 27001 A.5.15 map to?" and get an immediate, authoritative answer backed by ComplianceForge's comprehensive framework database.
|
|
71
|
-
|
|
72
|
-
---
|
|
73
|
-
|
|
74
|
-
## 🔒 Add Your Purchased Standards (Optional)
|
|
75
|
-
|
|
76
|
-
**NEW:** Import your purchased ISO 27001, NIST SP 800-53, or other standards to get:
|
|
77
|
-
|
|
78
|
-
✅ **Official text** from your licensed copies alongside SCF descriptions
|
|
79
|
-
✅ **Full clauses** with page numbers for compliance research
|
|
80
|
-
✅ **Enhanced queries** - see both SCF mappings AND official requirements
|
|
81
|
-
|
|
82
|
-
Your paid content stays private in `~/.security-controls-mcp/` (never committed to git).
|
|
83
|
-
|
|
84
|
-
**Quick example:**
|
|
85
|
-
```bash
|
|
86
|
-
# Install import tools
|
|
87
|
-
pip install -e '.[import-tools]'
|
|
88
|
-
|
|
89
|
-
# Import your purchased PDF
|
|
90
|
-
scf-mcp import-standard \
|
|
91
|
-
--file ~/Downloads/ISO-27001-2022.pdf \
|
|
92
|
-
--type iso_27001_2022 \
|
|
93
|
-
--title "ISO/IEC 27001:2022"
|
|
94
|
-
|
|
95
|
-
# Restart MCP, then query:
|
|
96
|
-
# "Show me GOV-01 with official ISO 27001 text"
|
|
97
|
-
```
|
|
98
|
-
|
|
99
|
-
**📖 Full Guide:** [PAID_STANDARDS_GUIDE.md](PAID_STANDARDS_GUIDE.md) - Complete setup, troubleshooting, and license compliance information.
|
|
100
|
-
|
|
101
|
-
---
|
|
102
|
-
|
|
103
|
-
## Installation & Setup
|
|
104
|
-
|
|
105
|
-
### Quick Install (Recommended)
|
|
106
|
-
|
|
107
|
-
**Option 1: Using pipx (Recommended)**
|
|
108
|
-
```bash
|
|
109
|
-
pipx install security-controls-mcp
|
|
110
|
-
```
|
|
111
|
-
|
|
112
|
-
**Option 2: Using pip**
|
|
113
|
-
```bash
|
|
114
|
-
pip install security-controls-mcp
|
|
115
|
-
```
|
|
116
|
-
|
|
117
|
-
**Option 3: From Source**
|
|
118
|
-
```bash
|
|
119
|
-
git clone https://github.com/Ansvar-Systems/security-controls-mcp.git
|
|
120
|
-
cd security-controls-mcp
|
|
121
|
-
pip install -e .
|
|
122
|
-
```
|
|
123
|
-
|
|
124
|
-
**Requirements:**
|
|
125
|
-
- Python 3.10 or higher
|
|
126
|
-
- pip or pipx
|
|
127
|
-
|
|
128
|
-
### Development Setup (For Contributors)
|
|
129
|
-
|
|
130
|
-
If you're contributing to the project, install development tools and pre-commit hooks:
|
|
131
|
-
|
|
132
|
-
```bash
|
|
133
|
-
# Install development dependencies
|
|
134
|
-
pip install -e '.[dev]'
|
|
135
|
-
|
|
136
|
-
# Install pre-commit hooks (runs tests/linting before each commit)
|
|
137
|
-
pre-commit install
|
|
138
|
-
```
|
|
139
|
-
|
|
140
|
-
Pre-commit hooks automatically run before each commit:
|
|
141
|
-
- **Code formatting** - black, ruff (auto-fixes)
|
|
142
|
-
- **Linting** - ruff check, YAML/JSON validation
|
|
143
|
-
- **Tests** - pytest, smoke tests, server startup test
|
|
144
|
-
|
|
145
|
-
**Bypass hooks (emergencies only):**
|
|
146
|
-
```bash
|
|
147
|
-
git commit --no-verify
|
|
148
|
-
```
|
|
149
|
-
|
|
150
|
-
**Run hooks manually:**
|
|
151
|
-
```bash
|
|
152
|
-
# All hooks on all files
|
|
153
|
-
pre-commit run --all-files
|
|
154
|
-
|
|
155
|
-
# Specific hook
|
|
156
|
-
pre-commit run black --all-files
|
|
157
|
-
```
|
|
158
|
-
|
|
159
|
-
### Claude Desktop Configuration
|
|
160
|
-
|
|
161
|
-
After installation, add to `claude_desktop_config.json`:
|
|
162
|
-
|
|
163
|
-
**If installed via pip/pipx:**
|
|
164
|
-
```json
|
|
165
|
-
{
|
|
166
|
-
"mcpServers": {
|
|
167
|
-
"security-controls": {
|
|
168
|
-
"command": "scf-mcp"
|
|
169
|
-
}
|
|
170
|
-
}
|
|
171
|
-
}
|
|
172
|
-
```
|
|
173
|
-
|
|
174
|
-
**If installed from source:**
|
|
175
|
-
```json
|
|
176
|
-
{
|
|
177
|
-
"mcpServers": {
|
|
178
|
-
"security-controls": {
|
|
179
|
-
"command": "python",
|
|
180
|
-
"args": ["-m", "security_controls_mcp"],
|
|
181
|
-
"cwd": "/path/to/security-controls-mcp"
|
|
182
|
-
}
|
|
183
|
-
}
|
|
184
|
-
}
|
|
185
|
-
```
|
|
186
|
-
|
|
187
|
-
**Config file location:**
|
|
188
|
-
- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
|
|
189
|
-
- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
|
|
190
|
-
|
|
191
|
-
### Cursor / VS Code Configuration
|
|
192
|
-
|
|
193
|
-
Same configuration under `"mcp.servers"` instead of `"mcpServers"` in your settings.
|
|
194
|
-
|
|
195
|
-
### Testing
|
|
196
|
-
|
|
197
|
-
```bash
|
|
198
|
-
# Run all tests
|
|
199
|
-
pytest tests/ -v
|
|
200
|
-
|
|
201
|
-
# Or run quick validation
|
|
202
|
-
python test_server.py
|
|
203
|
-
```
|
|
204
|
-
|
|
205
|
-
**📖 Full Documentation:**
|
|
206
|
-
- **[INSTALL.md](INSTALL.md)** - Detailed setup instructions
|
|
207
|
-
- **[TESTING.md](TESTING.md)** - Validation steps and example queries
|
|
208
|
-
- **[PAID_STANDARDS_GUIDE.md](PAID_STANDARDS_GUIDE.md)** - Import purchased standards for official text
|
|
209
|
-
|
|
210
|
-
---
|
|
211
|
-
|
|
212
|
-
## Example Queries
|
|
213
|
-
|
|
214
|
-
Ask Claude these natural language questions:
|
|
215
|
-
|
|
216
|
-
- *"What does GOV-01 require?"*
|
|
217
|
-
- *"Search for controls about encryption key management"*
|
|
218
|
-
- *"What ISO 27001 controls map to DORA?"*
|
|
219
|
-
- *"List all controls needed for PCI DSS compliance"*
|
|
220
|
-
- *"Which DORA requirements does ISO 27001 A.5.15 satisfy?"*
|
|
221
|
-
- *"Show me all NIST CSF 2.0 controls related to incident response"*
|
|
222
|
-
- *"Map CMMC Level 2 controls to FedRAMP requirements"*
|
|
223
|
-
|
|
224
|
-
---
|
|
225
|
-
|
|
226
|
-
## Available Frameworks (28 Total)
|
|
227
|
-
|
|
228
|
-
When you call `list_frameworks()`, you get:
|
|
229
|
-
|
|
230
|
-
```
|
|
231
|
-
Available Frameworks (28 total)
|
|
232
|
-
|
|
233
|
-
- nist_800_53_r5: NIST SP 800-53 Revision 5 (777 controls)
|
|
234
|
-
- soc_2_tsc: SOC 2 (TSC 2017:2022) (412 controls)
|
|
235
|
-
- pci_dss_4.0.1: PCI DSS v4.0.1 (364 controls)
|
|
236
|
-
- fedramp_r5_moderate: FedRAMP Revision 5 (Moderate) (343 controls)
|
|
237
|
-
- australia_ism_2024: Australian ISM (June 2024) (336 controls)
|
|
238
|
-
- csa_ccm_4: CSA Cloud Controls Matrix v4 (334 controls)
|
|
239
|
-
- iso_27002_2022: ISO/IEC 27002:2022 (316 controls)
|
|
240
|
-
- nist_csf_2.0: NIST Cybersecurity Framework 2.0 (253 controls)
|
|
241
|
-
- germany_c5_2020: Germany C5:2020 (Cloud Controls) (239 controls)
|
|
242
|
-
- cis_csc_8.1: CIS Critical Security Controls v8.1 (234 controls)
|
|
243
|
-
- singapore_mas_trm_2021: Singapore MAS TRM 2021 (214 controls)
|
|
244
|
-
- cmmc_2.0_level_2: CMMC 2.0 Level 2 (198 controls)
|
|
245
|
-
- nist_privacy_framework_1_0: NIST Privacy Framework 1.0 (187 controls)
|
|
246
|
-
- hipaa_security_rule: HIPAA Security Rule (136 controls)
|
|
247
|
-
- swift_cscf_2023: SWIFT Customer Security Framework 2023 (127 controls)
|
|
248
|
-
- dora: Digital Operational Resilience Act (DORA) (103 controls)
|
|
249
|
-
- germany_bait: Germany BAIT (Banking IT Requirements) (91 controls)
|
|
250
|
-
- nis2: Network and Information Security Directive (NIS2) (68 controls)
|
|
251
|
-
- ncsc_caf_4.0: NCSC Cyber Assessment Framework 4.0 (67 controls)
|
|
252
|
-
- cmmc_2.0_level_1: CMMC 2.0 Level 1 (52 controls)
|
|
253
|
-
- iso_27001_2022: ISO/IEC 27001:2022 (51 controls)
|
|
254
|
-
- gdpr: General Data Protection Regulation (GDPR) (42 controls)
|
|
255
|
-
- australia_essential_8: Australian Essential Eight (37 controls)
|
|
256
|
-
- netherlands: Netherlands Cybersecurity Regulations (27 controls)
|
|
257
|
-
- uk_cyber_essentials: UK Cyber Essentials (26 controls)
|
|
258
|
-
- sweden: Sweden Cybersecurity Regulations (25 controls)
|
|
259
|
-
- norway: Norway Cybersecurity Regulations (23 controls)
|
|
260
|
-
- germany: Germany Cybersecurity Regulations (18 controls)
|
|
261
|
-
```
|
|
262
|
-
|
|
263
|
-
**Framework categories:**
|
|
264
|
-
- **US Government:** NIST 800-53, NIST CSF, NIST Privacy, FedRAMP, CMMC
|
|
265
|
-
- **International Standards:** ISO 27001, ISO 27002, CIS CSC
|
|
266
|
-
- **US Industry:** PCI DSS, SOC 2, HIPAA
|
|
267
|
-
- **APAC:** Australia Essential Eight, Australia ISM, Singapore MAS TRM
|
|
268
|
-
- **EU Regulations:** GDPR, DORA, NIS2
|
|
269
|
-
- **UK Standards:** NCSC CAF, Cyber Essentials
|
|
270
|
-
- **European National:** Netherlands, Norway, Sweden, Germany (general/BAIT/C5)
|
|
271
|
-
- **Financial:** SWIFT CSCF
|
|
272
|
-
- **Cloud:** CSA CCM
|
|
273
|
-
|
|
274
|
-
---
|
|
275
|
-
|
|
276
|
-
## Framework Roadmap
|
|
277
|
-
|
|
278
|
-
**Not Yet Available (Waiting for SCF Coverage):**
|
|
279
|
-
|
|
280
|
-
These security frameworks are not currently included because the Secure Controls Framework (SCF) doesn't provide official mappings. We maintain data quality and compliance consulting credibility by using only ComplianceForge-vetted mappings.
|
|
281
|
-
|
|
282
|
-
- 🇳🇱 **Netherlands BIO** (Baseline Informatiebeveiliging Overheid) - Dutch government security baseline
|
|
283
|
-
- 🇫🇮 **Finland KATAKRI** - Finnish defense forces security audit criteria
|
|
284
|
-
- 🇳🇴 **Norway NSM** Grunnprinsipper - Norwegian NSA basic security principles
|
|
285
|
-
- 🇸🇪 **Sweden MSB** - Swedish Civil Contingencies Agency cybersecurity frameworks
|
|
286
|
-
- 🇩🇰 **Denmark CFCS** - Center for Cybersikkerhed guidelines
|
|
287
|
-
- 🇧🇪 **Belgium CCB** - Centre for Cybersecurity Belgium frameworks
|
|
288
|
-
- 🇫🇷 **France ANSSI** SecNumCloud - French cybersecurity agency cloud framework
|
|
289
|
-
|
|
290
|
-
**Note:** The European country frameworks we DO include (Netherlands, Norway, Sweden, Germany) map to national cybersecurity **laws and regulations** (article numbers from GDPR, NIS2, etc.), not the specific security baseline frameworks listed above.
|
|
291
|
-
|
|
292
|
-
**Want these frameworks?**
|
|
293
|
-
|
|
294
|
-
1. **For private use:** Fork this repository and use the [paid standards import feature](PAID_STANDARDS_GUIDE.md) to add your purchased frameworks
|
|
295
|
-
2. **For public benefit:** Contribute framework mappings to SCF at https://securecontrolsframework.com/contact/
|
|
296
|
-
|
|
297
|
-
---
|
|
298
|
-
|
|
299
|
-
## Tools
|
|
300
|
-
|
|
301
|
-
### 1. `get_control`
|
|
302
|
-
Get details about a specific SCF control by ID.
|
|
303
|
-
|
|
304
|
-
```python
|
|
305
|
-
get_control(control_id="GOV-01")
|
|
306
|
-
```
|
|
307
|
-
|
|
308
|
-
**Returns:** Full control details including description, domain, weight, PPTDF category, and mappings to all 28 frameworks.
|
|
309
|
-
|
|
310
|
-
---
|
|
311
|
-
|
|
312
|
-
### 2. `search_controls`
|
|
313
|
-
Search for controls by keyword in name or description.
|
|
314
|
-
|
|
315
|
-
```python
|
|
316
|
-
search_controls(query="encryption", limit=10)
|
|
317
|
-
```
|
|
318
|
-
|
|
319
|
-
**Optional parameters:**
|
|
320
|
-
- `frameworks` - Filter to specific frameworks (e.g., `["dora", "iso_27001_2022"]`)
|
|
321
|
-
- `limit` - Maximum results (default: 10)
|
|
322
|
-
|
|
323
|
-
---
|
|
324
|
-
|
|
325
|
-
### 3. `list_frameworks`
|
|
326
|
-
List all available frameworks with metadata.
|
|
327
|
-
|
|
328
|
-
```python
|
|
329
|
-
list_frameworks()
|
|
330
|
-
```
|
|
331
|
-
|
|
332
|
-
**Returns:** All 28 frameworks with display names and control counts.
|
|
333
|
-
|
|
334
|
-
---
|
|
335
|
-
|
|
336
|
-
### 4. `get_framework_controls`
|
|
337
|
-
Get all SCF controls that map to a specific framework.
|
|
338
|
-
|
|
339
|
-
```python
|
|
340
|
-
get_framework_controls(framework="dora")
|
|
341
|
-
```
|
|
342
|
-
|
|
343
|
-
**Returns:** All controls with mappings to the specified framework, organized by domain.
|
|
344
|
-
|
|
345
|
-
---
|
|
346
|
-
|
|
347
|
-
### 5. `map_frameworks`
|
|
348
|
-
Map controls between two frameworks via SCF.
|
|
349
|
-
|
|
350
|
-
```python
|
|
351
|
-
map_frameworks(
|
|
352
|
-
source_framework="iso_27001_2022",
|
|
353
|
-
source_control="A.5.15", # Optional: filter to specific control
|
|
354
|
-
target_framework="dora"
|
|
355
|
-
)
|
|
356
|
-
```
|
|
357
|
-
|
|
358
|
-
**Returns:** SCF controls that map to both frameworks, showing the connection between them.
|
|
359
|
-
|
|
360
|
-
---
|
|
361
|
-
|
|
362
|
-
### 6. `list_available_standards`
|
|
363
|
-
List all available standards including built-in SCF and any purchased standards you've imported.
|
|
364
|
-
|
|
365
|
-
```python
|
|
366
|
-
list_available_standards()
|
|
367
|
-
```
|
|
368
|
-
|
|
369
|
-
**Returns:** List of available standards with metadata (type, title, import date).
|
|
370
|
-
|
|
371
|
-
---
|
|
372
|
-
|
|
373
|
-
### 7. `query_standard`
|
|
374
|
-
Search within a specific purchased standard (requires import first).
|
|
375
|
-
|
|
376
|
-
```python
|
|
377
|
-
query_standard(
|
|
378
|
-
standard="iso_27001_2022",
|
|
379
|
-
query="access control",
|
|
380
|
-
limit=10
|
|
381
|
-
)
|
|
382
|
-
```
|
|
383
|
-
|
|
384
|
-
**Returns:** Relevant clauses/sections from the purchased standard with page numbers.
|
|
385
|
-
|
|
386
|
-
---
|
|
387
|
-
|
|
388
|
-
### 8. `get_clause`
|
|
389
|
-
Get the full text of a specific clause from a purchased standard.
|
|
390
|
-
|
|
391
|
-
```python
|
|
392
|
-
get_clause(
|
|
393
|
-
standard="iso_27001_2022",
|
|
394
|
-
clause_id="5.15"
|
|
395
|
-
)
|
|
396
|
-
```
|
|
397
|
-
|
|
398
|
-
**Returns:** Complete clause text with metadata from your purchased standard.
|
|
399
|
-
|
|
400
|
-
**Note:** Tools 6-8 require purchased standards to be imported first. See [PAID_STANDARDS_GUIDE.md](PAID_STANDARDS_GUIDE.md) for setup.
|
|
401
|
-
|
|
402
|
-
---
|
|
403
|
-
|
|
404
|
-
## Technical Architecture
|
|
405
|
-
|
|
406
|
-
**Data Pipeline:**
|
|
407
|
-
SCF JSON → In-memory index → MCP tools → AI response
|
|
408
|
-
|
|
409
|
-
**Key Principles:**
|
|
410
|
-
- All control text returns verbatim from SCF source data with zero LLM paraphrasing
|
|
411
|
-
- Framework mappings use ComplianceForge's authoritative control crosswalks
|
|
412
|
-
- Optional purchased standards stored locally in `~/.security-controls-mcp/` (never committed)
|
|
413
|
-
|
|
414
|
-
**Context Management:**
|
|
415
|
-
- Search results optimized for AI context windows
|
|
416
|
-
- Full control retrieval includes all framework mappings
|
|
417
|
-
- Cross-framework queries use bidirectional SCF mapping indices
|
|
418
|
-
|
|
419
|
-
**Data Integrity:**
|
|
420
|
-
- SCF version locked to 2025.4 for consistency
|
|
421
|
-
- Optional standards imported from user-purchased PDFs (with license compliance)
|
|
422
|
-
- All mappings sourced from official SCF framework crosswalks
|
|
423
|
-
|
|
424
|
-
---
|
|
425
|
-
|
|
426
|
-
## Data Source
|
|
427
|
-
|
|
428
|
-
Based on **SCF 2025.4** released December 29, 2025.
|
|
429
|
-
|
|
430
|
-
- **1,451 controls** across all domains
|
|
431
|
-
- **580+ framework mappings** (28 frameworks × 18-777 controls each)
|
|
432
|
-
- Licensed under **Creative Commons** (data)
|
|
433
|
-
- Source: [ComplianceForge SCF](https://securecontrolsframework.com/)
|
|
434
|
-
|
|
435
|
-
**Data files included in package:**
|
|
436
|
-
- `scf-controls.json` - All 1,451 controls with framework mappings
|
|
437
|
-
- `framework-to-scf.json` - Reverse index for framework-to-SCF lookups
|
|
438
|
-
|
|
439
|
-
---
|
|
440
|
-
|
|
441
|
-
## Important Disclaimers
|
|
442
|
-
|
|
443
|
-
**Not Legal or Compliance Advice:** Control text is sourced directly from official SCF data, but framework mappings and control interpretations are provided for research purposes only. This tool should not be used as the sole basis for compliance decisions. Always verify against official framework sources and consult qualified compliance professionals and auditors for your specific regulatory requirements.
|
|
444
|
-
|
|
445
|
-
**AI Content Restrictions:** The SCF license explicitly prohibits using AI systems to generate derivative content such as policies, standards, procedures, metrics, risks, or threats based on SCF data. You may query and analyze controls, but not generate derivative compliance artifacts.
|
|
446
|
-
|
|
447
|
-
**Purchased Standards:** Optional standards imports (ISO, NIST) require valid licenses. You must own legitimate copies and comply with copyright restrictions. This tool does not include or distribute any copyrighted standards text.
|
|
448
|
-
|
|
449
|
-
**Framework Coverage:** While SCF provides comprehensive mappings, not all controls map 1:1 across frameworks. Some controls may be interpreted, consolidated, or split during mapping. Always review official framework documentation for authoritative requirements.
|
|
450
|
-
|
|
451
|
-
---
|
|
452
|
-
|
|
453
|
-
## Related Projects: Complete Compliance Suite
|
|
454
|
-
|
|
455
|
-
This server is part of **Ansvar's Compliance Suite** - three MCP servers that work together for end-to-end compliance coverage:
|
|
456
|
-
|
|
457
|
-
### 🇪🇺 [EU Regulations MCP](https://github.com/Ansvar-Systems/EU_compliance_MCP)
|
|
458
|
-
**Query 47 EU regulations directly from Claude**
|
|
459
|
-
- GDPR, AI Act, DORA, NIS2, MiFID II, PSD2, eIDAS, Medical Device Regulation, and 39 more
|
|
460
|
-
- Full regulatory text with article-level search
|
|
461
|
-
- Cross-regulation reference and comparison
|
|
462
|
-
- **Install:** `npx @ansvar/eu-regulations-mcp`
|
|
463
|
-
|
|
464
|
-
### 🇺🇸 [US Regulations MCP](https://github.com/Ansvar-Systems/US_Compliance_MCP)
|
|
465
|
-
**Query US federal and state compliance laws directly from Claude**
|
|
466
|
-
- HIPAA, CCPA, SOX, GLBA, FERPA, COPPA, FDA 21 CFR Part 11, and 8 more
|
|
467
|
-
- Federal and state privacy law comparison
|
|
468
|
-
- Breach notification timeline mapping
|
|
469
|
-
- **Install:** `npm install @ansvar/us-regulations-mcp`
|
|
470
|
-
|
|
471
|
-
### 🔐 Security Controls MCP (This Project)
|
|
472
|
-
**Query 1,451 security controls across 28 frameworks**
|
|
473
|
-
- ISO 27001, NIST CSF, DORA, PCI DSS, SOC 2, CMMC, FedRAMP, and 21 more
|
|
474
|
-
- Bidirectional framework mapping and gap analysis
|
|
475
|
-
- Import your purchased standards for official text
|
|
476
|
-
- **Install:** `pipx install security-controls-mcp`
|
|
477
|
-
|
|
478
|
-
### How They Work Together
|
|
479
|
-
|
|
480
|
-
**Regulations → Controls Implementation Workflow:**
|
|
481
|
-
|
|
482
|
-
```
|
|
483
|
-
1. "What DORA requirements apply to ICT risk management?"
|
|
484
|
-
→ EU Regulations MCP returns Article 6 full text
|
|
485
|
-
|
|
486
|
-
2. "What security controls satisfy DORA Article 6?"
|
|
487
|
-
→ Security Controls MCP maps to ISO 27001, NIST CSF, and SCF controls
|
|
488
|
-
|
|
489
|
-
3. "Show me ISO 27001 A.8.1 implementation details"
|
|
490
|
-
→ Security Controls MCP returns control requirements and framework mappings
|
|
491
|
-
```
|
|
492
|
-
|
|
493
|
-
**Complete compliance in one chat:**
|
|
494
|
-
- **EU/US Regulations MCPs** tell you WHAT compliance requirements you must meet
|
|
495
|
-
- **Security Controls MCP** tells you HOW to implement controls that satisfy those requirements
|
|
496
|
-
|
|
497
|
-
### Specialized: OT/ICS Security
|
|
498
|
-
|
|
499
|
-
### 🏭 [OT Security MCP](https://github.com/Ansvar-Systems/ot-security-mcp)
|
|
500
|
-
**Query IEC 62443, NIST 800-82/53, and MITRE ATT&CK for ICS**
|
|
501
|
-
- Specialized for OT/ICS environments (manufacturing, energy, critical infrastructure)
|
|
502
|
-
- Security levels, Purdue Model, zone/conduit architecture
|
|
503
|
-
- MITRE ATT&CK for ICS threat intelligence
|
|
504
|
-
- **Install:** `npm install @ansvar/ot-security-mcp`
|
|
505
|
-
- **Use case:** Industrial control systems, SCADA, PLCs, critical infrastructure
|
|
506
|
-
|
|
507
|
-
---
|
|
508
|
-
|
|
509
|
-
## Developer Information
|
|
510
|
-
|
|
511
|
-
**Built by:** [Ansvar Systems](https://ansvar.eu) (Stockholm, Sweden) — specializes in AI-accelerated threat modeling and compliance tools
|
|
512
|
-
|
|
513
|
-
**License:** Apache License 2.0 (code) / CC BY-ND 4.0 (data)
|
|
514
|
-
|
|
515
|
-
**Documentation:**
|
|
516
|
-
- [INSTALL.md](INSTALL.md) - Complete installation guide for all platforms
|
|
517
|
-
- [TESTING.md](TESTING.md) - Validation steps and example queries
|
|
518
|
-
- [PAID_STANDARDS_GUIDE.md](PAID_STANDARDS_GUIDE.md) - Import purchased standards
|
|
519
|
-
- [LEGAL_COMPLIANCE.md](LEGAL_COMPLIANCE.md) - License requirements and restrictions
|
|
520
|
-
|
|
521
|
-
**Related Projects:**
|
|
522
|
-
- **[EU Regulations MCP](https://github.com/Ansvar-Systems/eu-regulations-mcp)** - Query 37 EU regulations (AI Act, DORA, NIS2, GDPR, etc.) for complete EU compliance coverage
|
|
523
|
-
|
|
524
|
-
---
|
|
525
|
-
|
|
526
|
-
## License
|
|
527
|
-
|
|
528
|
-
### Code License
|
|
529
|
-
|
|
530
|
-
The source code in this repository is licensed under the **Apache License 2.0** (see [LICENSE](LICENSE)).
|
|
531
|
-
|
|
532
|
-
### Data License
|
|
533
|
-
|
|
534
|
-
The SCF control data (`scf-controls.json`, `framework-to-scf.json`) is licensed under the **Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0)** by ComplianceForge.
|
|
535
|
-
|
|
536
|
-
- **Source:** [Secure Controls Framework (SCF)](https://securecontrolsframework.com/)
|
|
537
|
-
- **License:** [CC BY-ND 4.0](https://creativecommons.org/licenses/by-nd/4.0/)
|
|
538
|
-
- **Copyright:** ComplianceForge
|
|
539
|
-
- **Version:** SCF 2025.4 (Released December 29, 2025)
|
|
540
|
-
|
|
541
|
-
#### ⚠️ Important: AI Derivative Content Restriction
|
|
542
|
-
|
|
543
|
-
The SCF license **explicitly prohibits** using AI systems (including Claude) to generate derivative content such as policies, standards, procedures, metrics, risks, or threats based on SCF data.
|
|
544
|
-
|
|
545
|
-
**You MAY:**
|
|
546
|
-
- Query and analyze SCF controls
|
|
547
|
-
- Map between frameworks (e.g., "What DORA controls does ISO 27001 A.5.15 map to?")
|
|
548
|
-
- Reference controls in your own work (with proper attribution)
|
|
549
|
-
- Use this MCP server to understand control requirements
|
|
550
|
-
|
|
551
|
-
**You MAY NOT:**
|
|
552
|
-
- Ask Claude (or any AI) to generate policies or procedures based on SCF controls
|
|
553
|
-
- Create derivative frameworks or modified versions for distribution
|
|
554
|
-
- Remove or modify control definitions
|
|
555
|
-
|
|
556
|
-
For complete terms and conditions, see: [SCF Terms & Conditions](https://securecontrolsframework.com/terms-conditions/)
|
|
File without changes
|
{security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/entry_points.txt
RENAMED
|
File without changes
|
{security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/licenses/LICENSE
RENAMED
|
File without changes
|
|
File without changes
|
{security_controls_mcp-0.3.1.dist-info → security_controls_mcp-0.3.3.dist-info}/top_level.txt
RENAMED
|
File without changes
|