FedRAMP 20x MCP Server

An MCP (Model Context Protocol) server that provides access to FedRAMP 20x security requirements and controls with Azure-first guidance.

Overview

This server loads FedRAMP 20x data from the official FedRAMP documentation repository and provides tools for querying requirements by control, family, or keyword.

Data Sources:

• Requirements Data: JSON files from github.com/FedRAMP/docs (root directory)
• Documentation: Markdown files from github.com/FedRAMP/docs/tree/main/docs

Azure Focus: All implementation examples, architecture patterns, and vendor recommendations prioritize Microsoft Azure services (Azure Government, Microsoft Entra ID, Azure Key Vault, AKS, Azure Functions, Bicep, etc.) while remaining cloud-agnostic where appropriate.

Data Coverage

The server provides access to 321 requirements (199 FRRs + 72 KSIs + 50 FRDs) across FedRAMP 20x documents:

FedRAMP Requirements (FRR) - 199 requirements across 10 families:

• ADS - Authorization Data Sharing (20 requirements)
• CCM - Collaborative Continuous Monitoring (25 requirements)
• FSI - FedRAMP Security Inbox (16 requirements)
• ICP - Incident Communications Procedures (9 requirements)
• MAS - Minimum Assessment Scope (12 requirements)
• PVA - Persistent Validation and Assessment (22 requirements)
• RSC - Recommended Secure Configuration (10 requirements)
• SCN - Significant Change Notifications (22 requirements)
• UCM - Using Cryptographic Modules (4 requirements)
• VDR - Vulnerability Detection and Response (57 requirements)
• KSI - Key Security Indicators (2 requirements)

Key Security Indicators (KSI) - 72 indicators across 11 families:

• AFR - Architecture, Features, and Resources (11 indicators)
• CED - Continuous Evidence Delivery (4 indicators)
• CMT - Continuous Monitoring and Testing (5 indicators)
• CNA - Cloud Native Architecture (8 indicators)
• IAM - Identity and Access Management (7 indicators)
• INR - Incident and Near-Miss Reporting (3 indicators)
• MLA - Monitoring, Logging, and Alerting (8 indicators)
• PIY - Privacy and Transparency (8 indicators)
• RPL - Resilience and Recovery Planning (4 indicators)
• SVC - Secure Coding and Vulnerability Management (10 indicators)
• TPR - Third-Party Risk Management (4 indicators)

FedRAMP Definitions (FRD) - 50 official term definitions

Features

• 🎯 Automated Evidence Collection (NEW): Automation guidance for 65 active KSIs with Azure-native services, ready-to-use queries, and artifact specifications
• Query by Control: Get detailed information about specific FedRAMP requirements
• Query by Family: List all requirements within a family
• Keyword Search: Search across all requirements using keywords
• FedRAMP Definitions: Look up official FedRAMP term definitions
• Key Security Indicators: Access and query FedRAMP Key Security Indicators (KSI) with implementation status
• Documentation Search: Search and retrieve official FedRAMP documentation markdown files
• Dynamic Content: Automatically discovers and loads all markdown documentation files
• Implementation Planning: Generate strategic interview questions to help product managers and engineers think through FedRAMP 20x implementation considerations
• AST-Powered Code Analysis: Advanced Abstract Syntax Tree parsing using tree-sitter for accurate, context-aware security analysis across Python, C#, Java, TypeScript/JavaScript, Bicep, and Terraform
• Semantic Analysis: Deep code understanding with symbol resolution, control flow analysis, and interprocedural analysis capabilities
• 🚀 Pattern-Based Architecture: Unified analysis engine with 381 YAML patterns across 23 requirement families, supporting compliance analysis for KSIs and FRRs
• Pattern Engine: Declarative YAML-driven detection across 14 languages with AST-first analysis and intelligent finding categorization
• 🎯 Context-Aware Filtering (NEW): Reduce false positives by specifying your application type (cli-tool, mcp-server, web-app, api-service, iac-only, library, batch-job, full) via the application_profile parameter on analysis tools

Pattern-Based Analysis Architecture

The server uses a unified pattern-based architecture for all FedRAMP 20x compliance analysis:

Architecture Overview:

• 381 YAML patterns across 23 requirement families
• Single analysis engine (GenericPatternAnalyzer) replaces 271 traditional analyzers
• 14 languages supported: Python, C#, Java, TypeScript, JavaScript, Bicep, Terraform, GitHub Actions, Azure Pipelines, GitLab CI, YAML, JSON, Dockerfile, GitHub
• AST-first detection with tree-sitter for accuracy, regex fallback when needed
• Declarative patterns that are easy to maintain and extend

Pattern Coverage by Family:

• Application Families: ADS, AFR, CCM, CED, CMT, CNA, IAM, INR, MLA, PIY, RPL, RSC, SCN, SVC, TPR, UCM, VDR (17 families)
• Infrastructure Families: COMMON, FSI, ICP, KSI, MAS, PVA (6 families)
• KSI & FRR Mapping: 72 KSIs and 199 FRRs supported through pattern definitions

How It Works:

1. Pattern Loading: YAML patterns loaded from data/patterns/ directory
2. Analysis Execution: Code analyzed using tree-sitter AST parsing with pattern matching
3. Finding Generation: Patterns generate findings with severity, description, and remediation
4. Result Aggregation: Findings grouped by requirement family with deduplication

Benefits:

• ✅ Consistency: Same detection logic across all languages
• ✅ Maintainability: Update patterns in YAML instead of Python code
• ✅ Performance: Pattern compilation and caching optimize analysis speed
• ✅ Extensibility: Add new patterns without code changes
• ✅ Accuracy: AST-based detection reduces false positives

Important Clarification: OSCAL Format FedRAMP 20x requires machine-readable formats (JSON, XML, or structured data) for Authorization Data Sharing. OSCAL is NOT mentioned in FedRAMP 20x requirements - it's a NIST standard that can be used as one potential implementation approach. The actual requirement is simply "machine-readable" - you can use custom JSON/XML or OSCAL based on your implementation needs.

Installation

Prerequisites

• Python 3.10 or higher
• pip (included with Python)
• Python must be in your system PATH

Setup

# Clone the repository
git clone https://github.com/KevinRabun/FedRAMP20xMCP.git
cd FedRAMP20xMCP

# Create virtual environment and install
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
pip install -e .

# If using uv (alternative package manager):
uv pip install -e .

Dependencies:

• mcp>=1.2.0 - Model Context Protocol SDK
• httpx>=0.27.0 - HTTP client for fetching FedRAMP data
• openpyxl>=3.1.0 - Excel file generation for export features
• python-docx>=1.1.0 - Word document generation for KSI specifications
• tree-sitter>=0.21.0 - AST parsing library for code analysis
• tree-sitter-python>=0.21.0 - Python language bindings for tree-sitter
• tree-sitter-c-sharp>=0.21.0 - C# language bindings for tree-sitter
• tree-sitter-java>=0.21.0 - Java language bindings for tree-sitter
• tree-sitter-javascript>=0.21.0 - JavaScript/TypeScript language bindings

Troubleshooting:

If you encounter issues, see Advanced Setup Guide for detailed troubleshooting steps.

Security

Vulnerability Disclosure: If you discover a security vulnerability, please see our Security Policy for responsible disclosure procedures (KSI-PIY-03).

Audit Logging: All MCP server operations are logged to stderr for audit purposes (KSI-MLA-05).

Security Features:

• ✅ No authentication required (local development tool)
• ✅ No Federal Customer Data handling
• ✅ HTTPS-only connections to GitHub
• ✅ 1-hour cache TTL reduces external requests
• ✅ All dependencies use minimum secure versions

For complete security documentation, see SECURITY.md.

Usage

With VS Code and GitHub Copilot

1. Install the VS Code MCP extension (if not already installed)

2. Configure the MCP server - Choose one of the following scopes: