Scf MCP server
{
"mcpServers": {
"scfcontrolsplatform": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf@latest"
],
"env": {
"SCF_API_URL": "https://...",
"SCF_API_KEY": "<scf_api_key>"
}
}
}
}{
"mcpServers": {
"scfcontrolsplatform": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf@latest"
],
"env": {
"SCF_API_URL": "https://...",
"SCF_API_KEY": "<scf_api_key>"
}
}
}
}{
"mcpServers": {
"scfcontrolsplatform": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf@latest"
],
"env": {
"SCF_API_URL": "https://...",
"SCF_API_KEY": "<scf_api_key>"
}
}
}
}{
"servers": {
"scfcontrolsplatform": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf@latest"
],
"env": {
"SCF_API_URL": "${input:scf_api_url}",
"SCF_API_KEY": "${input:scf_api_key}"
}
}
},
"inputs": [
{
"id": "scf_api_url",
"type": "promptString",
"description": "Scf api url",
"password": true
},
{
"id": "scf_api_key",
"type": "promptString",
"description": "Scf api key",
"password": true
}
]
}{
"mcpServers": {
"scfcontrolsplatform": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf@latest"
],
"env": {
"SCF_API_URL": "https://...",
"SCF_API_KEY": "<scf_api_key>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y mcp-server-scfversion 3.4.2
What it does
MCP server that connects AI assistants to the SCF Controls Platform, providing access to 1,451 security controls, 354+ compliance framework mappings, evidence tracking, risk registers, and vendor risk management. Built for organizations using the Secure Controls Framework who want to automate compliance workflows through natural language.
- Browse and query the SCF control catalog across frameworks like NIST 800-53, ISO 27001, SOC 2, and FedRAMP to find relevant controls for your environment.
- Track security control implementation status through an 8-state workflow and manage evidence collection with maturity scoring.
- Assess and monitor vendor risk using the TPRM tools, including vendor registry management and async AI security assessments.
Tools this server exposes
| Tool | Does |
|---|---|
| catalog_browse | Search and retrieve security controls from the SCF catalog with framework mappings and assessment objectives. |
| scoped_controls_list | View and manage implementation status of controls across an 8-state workflow. |
| evidence_create | Add and track evidence for control implementation. |
| evidence_assess | Run AI-based assessments on evidence with maturity scoring. |
| risk_register_list | View and manage organizational risks with 5x5 risk matrix scoring. |
| vendor_list | Manage vendor registry and track third-party risk assessments. |
| vendor_assess | Initiate async AI security research and assessment for vendors. |
| organization_users | Manage users, organizations, and audit trail information. |
| engagement_create | Create audit engagement workspaces with frozen scope and framework-native presentation. |
| document_generate | Generate ISMS documentation and manage document sections and lifecycle. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.