Log inSubmit server
MCP Server Scf logo

MCP Server Scf

Connect AI assistants to SCF controls, compliance frameworks, evidence tracking, scoping, and implementation data over MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Server Scf

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-server-scf": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-server-scf"
      ],
      "env": {
        "SCF_LOAD_ALL_TOOLS": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

mcp-server-scf connects AI assistants to the SCF Controls Platform for security compliance and risk-management workflows. It exposes catalog queries for controls, frameworks, domains, evidence types, and assessment objectives, along with organization-scoped control and evidence operations. Use it to inspect compliance coverage, update implementation status, manage evidence records, and review evidence health from an MCP-compatible client. The server runs with Node.js 20 or newer and can load tool groups on demand.

Use cases

  • Browse SCF controls and their compliance framework mappings
  • Review implementation status and coverage across an organization
  • Track evidence collection and identify coverage gaps
  • Preview framework scope changes before applying them

Key features

  • SCF control and compliance framework catalog access
  • Organization-scoped control management
  • Framework-based scoping with preview and overrides
  • Evidence maturity, health, and gap analysis
  • Evidence file metadata and expiring download URLs
  • On-demand loading of MCP tool groups

Tools196

What MCP Server Scf lets your agent do. Expand a tool for its parameters.

Verified live~50.3k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

22/22 checks healthy over the last 91d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 4d ago via OSV.dev · mcp-server-scf (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars3Stargazers on the source repository.
npm downloads2.9kPackage downloads in the last 30 days.
Last commit6d agoMost recent push to the default branch.
Tools exposed196Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Server Scf works

What mcp-server-scf does

mcp-server-scf links MCP-compatible AI assistants with the SCF Controls Platform. Its catalog functions provide access to SCF security controls, mapped compliance frameworks, taxonomy domains, standard evidence types, and assessment objectives. Control records include framework mappings, assessment objectives, and related evidence references.

For organization-specific work, the server can list and inspect scoped controls, update implementation fields, calculate scoping statistics, and manage framework-based scope. It also supports evidence tracking, including creating records from catalog evidence, updating tracking fields, reviewing maturity, finding coverage gaps, checking collection health, and inspecting uploaded evidence files.

The catalog covers frameworks such as NIST 800-53, ISO 27001, SOC 2, FedRAMP, and GDPR, along with many additional mappings. The platform content includes 1,451 SCF controls, more than 350 framework mappings, 272 standard evidence types, and 5,736 assessment objectives.

How it works

The server communicates with the SCF Controls Platform through MCP tools. Catalog reads are separate from organization-level reads and writes, so an agent can browse reference definitions without changing an organization’s records.

Tool availability can be staged by group. Core groups load at startup, while additional groups can be loaded with scf_load_tools; the server then notifies the client that the tool list changed. Setting SCF_LOAD_ALL_TOOLS=true makes all tool groups available at startup for clients that do not process tool-list change notifications.

Several operations are paginated and support filters such as domain, framework, free-text search, scope status, weighting, CSF function, or system. Write operations identify controls by SCF ID where specified. Framework scope changes can be previewed before application, while bulk updates can process up to 500 scoped controls in one transaction.

Setup and configuration

Run the package through npx with an MCP client or MCP Inspector:

Terminal
npx -y mcp-server-scf

For a local inspection session, the documented Inspector command is:

Terminal
npx @modelcontextprotocol/inspector npx -y mcp-server-scf

The package requires Node.js 20 or newer. Authentication and platform connection settings are part of the server setup, and write operations depend on the user role assigned by the platform. Viewer access supports read operations; editor-level access is required for most updates, and framework unscoping requires an editor role.

Tools and capabilities

  • Browse controls, frameworks, domains, evidence definitions, and assessment objectives.
  • Inspect organization-scoped controls, implementation status, owners, notes, linked evidence, and audit history.
  • Scope controls by framework, preview scope changes, set per-control overrides, and remove framework scope.
  • Track evidence, review maturity and upgrade recommendations, identify gaps, and check collection freshness.
  • List uploaded evidence files and retrieve time-limited pre-signed download URLs.

The broader platform tool groups also cover assessments, risk, vendors, systems, organizations, teams, collaboration, documents, engagements, assurance, catalog reconciliation, webhooks, and journey workflows.

Limitations and notes

Write tools change organization data and should be used with role-appropriate credentials. Bulk unscoping is destructive, although controls shared with another in-scope framework are retained and their notes and status survive. Evidence download URLs expire after 15 minutes.

Clients that do not handle MCP tool-list change notifications may need SCF_LOAD_ALL_TOOLS=true. The package is published under the MIT license, while the separately referenced open-source SCF Controls Platform is published under AGPL-3.0; these are distinct projects and licenses.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Server Scf

mcp-server-scf is an MCP server that connects AI assistants to the SCF Controls Platform. Its main tools browse SCF controls, frameworks, domains, evidence catalogs, and assessment objectives, while also managing organization-scoped controls, implementation status, evidence tracking, framework scope, and evidence health.

Install or run it with `npx -y mcp-server-scf` using an MCP-compatible client. The server requires Node.js 20 or newer. MCP Inspector can launch it with `npx @modelcontextprotocol/inspector npx -y mcp-server-scf` for local tool inspection.

Set `SCF_LOAD_ALL_TOOLS=true` before starting the server. By default, core tool groups load first and additional groups can be loaded through `scf_load_tools`; the server sends a tool-list change notification after loading.

Yes. Editor-level users can update scoped control fields, batch-update up to 500 controls, change framework scope, create evidence records, and update evidence tracking fields. Viewer-level users can perform supported read operations, while destructive framework unscoping requires an editor role.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Server Scf AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mcp-server-scf?style=directory)](https://allmcps.com/mcp/mcp-server-scf)
HTML Embed
<a href="https://allmcps.com/mcp/mcp-server-scf"><img src="https://allmcps.com/api/badge/mcp-server-scf?style=directory" alt="MCP Server Scf on AllMCPs" /></a>