MCP Server Scf

What mcp-server-scf does

The mcp-server-scf MCP server gives AI assistants an MCP interface to the SCF Controls Platform. It covers the platform’s security compliance and governance data, including 1,451 SCF controls, more than 354 framework mappings, assessment objectives, evidence definitions, implementation status, risks, and vendors.

The server is intended for organizations running the SCF Controls Platform. Agents can use it to browse catalog content, follow control implementation progress, organize evidence, assess risk, manage third-party risk, and work with audit or documentation workflows.

How it works

The package runs as a local Node.js process and communicates with an MCP client over standard input and output. The client discovers the available tools and their schemas, then sends tool calls based on the user’s request. The server forwards authenticated operations to the configured SCF Controls Platform instance.

The repository describes 196 tools grouped into 14 domains. These domains cover catalog access, control scoping, evidence, risk, vendors, organization data, capabilities, webhooks, documents, audit engagements, catalog reconciliation, teams, collaboration, and guided journeys.

Setup and configuration

First deploy or otherwise obtain access to an SCF Controls Platform instance. The README points to the open-source platform, which can be hosted with Docker Compose and includes PostgreSQL, Redis, and MinIO. There is no hosted-platform signup step described in the setup material.

Configure the server with these environment variables:

• SCF_API_URL: The base URL of the SCF Controls Platform, such as a local instance at http://localhost:8000.
• SCF_API_KEY: The API key used to authenticate requests.

The key can be supplied through the platform’s environment configuration or created from its Settings → API Keys area after startup. Both variables must be available to the process for live tool calls. The package can also be started through MCP Inspector with npx @modelcontextprotocol/inspector npx -y mcp-server-scf; Inspector can display tool schemas without credentials, but calls return a configuration error when the URL or key is missing.

Tools and capabilities

The mcp-server-scf MCP server organizes its operations as follows:

• Catalog: browse controls, frameworks, assessment objectives, domains, and evidence definitions.
• Control scoping: manage implementation states, framework scope, coverage, and control overrides.
• Evidence: track evidence and tasks, review files, validate submissions, and handle assessment queues.
• Risk and vendors: maintain risk records, scoring, traceability, vendor assessments, certifications, and remediation actions.
• Organization and collaboration: work with users, teams, assignments, notifications, comments, and audit trails.
• Documents and engagements: generate and edit ISMS documents, manage lifecycle changes, and operate audit workspaces.
• Platform administration: manage webhooks, catalog upgrades, capabilities, guided journeys, and related organization workflows.

Limitations and notes

The server connects to the SCF Controls Platform; it does not provide a standalone compliance database. A reachable platform instance and valid API key are needed for operations that read or change platform data. MCP Inspector can inspect schemas without those credentials, but it cannot complete live requests in that state.

The README distinguishes supported platform operations from deferred or intentionally excluded operations in the repository’s tool-scope documentation. Review that scope before relying on a specific platform workflow.