framework-mcp
Advanced tools
Dual-architecture server (MCP + HTTP API) for determining vendor tool capability roles against CIS Controls Framework. Supports Microsoft Copilot custom connectors and DigitalOcean App Services deployment.
A Model Context Protocol (MCP) server that determines vendor tool capability roles (Full Implementation, Partial Implementation, Facilitates, Governance, Validates) against the CIS Controls Framework. This tool helps security professionals accurately categorize vendor capabilities for specific CIS Control safeguards through comprehensive content-based analysis.
This MCP server enables security teams to:
| Capability Role | Description | Assessment Approach |
|---|---|---|
| FULL | Complete implementation of safeguard requirements | Comprehensive content analysis for complete coverage |
| PARTIAL | Limited scope implementation with clear boundaries | Content analysis identifies explicit scope limitations |
| FACILITATES | Enhancement capabilities that enable others to implement safeguards better/faster/stronger | Analysis identifies facilitation language and indirect support |
| GOVERNANCE | Policy/process management and oversight capabilities | Analysis identifies policy, process, and oversight elements |
| VALIDATES | Verification capabilities providing evidence and reporting | Analysis identifies audit, monitoring, and reporting capabilities |
The server uses the CIS Controls visual framework with color-coded categorization:
npm install -g framework-mcp
npm update -g framework-mcp
Or reinstall to get the latest version:
npm uninstall -g framework-mcp
npm install -g framework-mcp
git clone https://github.com/therealcybermattlee/FrameworkMCP.git
cd FrameworkMCP
npm install
npm run build
# Deploy using the included configuration
doctl apps create .do/app.yaml
railway login
railway up
Connect your GitHub repository and use:
npm install && npm run buildnpm run start:httpDeploy to any cloud platform and use the included swagger.json for Copilot integration.
Add to your MCP configuration file (~/.config/claude-code/mcp.json):
{
"mcpServers": {
"framework-analyzer": {
"command": "node",
"args": ["/path/to/FrameworkMCP/dist/index.js"],
"env": {}
}
}
}
Deploy the Framework MCP HTTP API to any cloud platform (DigitalOcean, Railway, Render, etc.)
swagger.json file from this repository/health endpoint to verify connectivityIn your Copilot, create actions for capability assessment:
Primary Action - Validate Vendor Capability:
Action: Validate Vendor Mapping
Description: Validate vendor capability claims against CIS Controls through content analysis
Connector: Framework MCP Custom Connector
Operation: validateVendorMapping
Parameters:
- vendor_name: {User provided vendor name}
- safeguard_id: {CIS safeguard ID like "1.1"}
- claimed_capability: {full|partial|facilitates|governance|validates}
- supporting_text: {Vendor response text}
Secondary Action - Analyze Response:
Action: Analyze Vendor Response
Description: Determine appropriate capability role for vendor response
Connector: Framework MCP Custom Connector
Operation: analyzeVendorResponse
Parameters:
- vendor_name: {User provided vendor name}
- safeguard_id: {CIS safeguard ID}
- response_text: {Vendor response to analyze}
Once configured, users can interact with your Copilot:
"Validate this vendor capability: CrowdStrike Falcon claims FULL coverage for safeguard 1.1 with this response: 'Our platform provides comprehensive enterprise asset inventory with real-time discovery, automated classification, and continuous monitoring of all hardware and software assets.'"
"Analyze this vendor response for safeguard 5.1: Microsoft Entra ID - 'We provide centralized identity management with automated user provisioning, role-based access controls, and integration with all major business applications.'"
"What are the requirements for CIS safeguard 6.3?"
# For MCP usage
claude-code "List available CIS Control safeguards"
# For HTTP API usage
curl https://your-api-url.com/health
# For Copilot testing
curl -X POST https://your-api-url.com/api/validate-vendor-mapping \
-H "Content-Type: application/json" \
-d '{"vendor_name":"Test Vendor","safeguard_id":"1.1","claimed_capability":"facilitates","supporting_text":"We provide supplemental asset tracking capabilities that enhance existing inventory systems."}'
claude-code "Determine the capability role for this vendor response to safeguard 5.1:
Vendor: SecureIAM Corp
Response: 'Our tool is a full identity provider with comprehensive account management. We maintain detailed user inventories including names, usernames, departments, and access rights. Automated quarterly reviews ensure all accounts are authorized and compliant.'"
claude-code "Validate this implementation capability claim:
Vendor: ComplianceBot
Safeguard: 5.1
Claimed Capability: FULL
Response: 'We provide automated account lifecycle management with real-time inventory tracking and compliance reporting.'"
Create vendors.csv:
vendor,safeguard,response
VendorA,5.1,"Complete IAM solution with policy management and quarterly reviews"
VendorB,5.1,"Basic user directory with manual account tracking"
VendorC,6.3,"MFA enforcement for all external applications with SSO integration"
claude-code "Determine capability roles for the vendor responses in vendors.csv and provide recommendations"
claude-code "Show me the detailed breakdown of safeguard 5.1 including all sub-elements"
PRIMARY TOOL: Validate whether a vendor's stated capability mapping is actually supported by their explanatory text.
claude-code "Use validate_vendor_mapping with vendor_name 'SecureAssets Corp', safeguard_id '1.1', claimed_capability 'full', and supporting_text 'Our comprehensive asset management platform performs automated discovery of all enterprise devices, maintains detailed hardware and software inventories, tracks ownership and location data, provides real-time asset status monitoring, and includes documented inventory procedures with bi-annual review capabilities.'"
{
"vendor": "SecureIAM Corp",
"safeguardId": "5.1",
"safeguardTitle": "Establish and Maintain an Inventory of Accounts",
"capabilityRole": "full",
"additionalRoles": ["governance", "validates"],
"confidence": 87,
"contentAnalysis": {
"implementationLanguage": "strong",
"scopeDefinition": "comprehensive",
"evidenceQuality": "high"
},
"evidenceAnalysis": {
"coreRequirements": 85,
"subElements": 75,
"governance": 90,
"languageConsistency": 88
},
"evidence": [
"comprehensive account management",
"detailed user inventories",
"automated quarterly reviews"
]
}
{
"vendor": "SecureAssets Corp",
"safeguard_id": "1.1",
"safeguard_title": "Establish and Maintain a Detailed Enterprise Asset Inventory",
"claimed_capability": "full",
"validation_status": "SUPPORTED",
"confidence_score": 85,
"evidence_analysis": {
"core_requirements_coverage": 100,
"sub_elements_coverage": 47,
"governance_alignment": 80,
"language_consistency": 90
},
"content_validation": {
"implementation_depth": "comprehensive",
"scope_clarity": "well_defined",
"evidence_strength": "strong",
"capability_aligned": true
},
"gaps_identified": [],
"strengths_identified": [
"High coverage of core requirements and sub-elements",
"Strong implementation language consistency",
"Comprehensive coverage with clear implementation details"
],
"recommendations": [],
"detailed_feedback": "Validation of FULL capability claim: SUPPORTED (85% alignment)\n\nSTRENGTHS:\n• High coverage of core requirements and sub-elements\n• Strong implementation language consistency\n• Comprehensive coverage with clear implementation details\n\nASSESSMENT: The vendor's supporting evidence strongly aligns with their claimed capability."
}
{
"vendor": "BasicTracker Pro",
"safeguard_id": "1.1",
"safeguard_title": "Establish and Maintain a Detailed Enterprise Asset Inventory",
"claimed_capability": "full",
"validation_status": "UNSUPPORTED",
"confidence_score": 35,
"evidence_analysis": {
"core_requirements_coverage": 40,
"sub_elements_coverage": 15,
"governance_alignment": 25,
"language_consistency": 60
},
"content_validation": {
"implementation_depth": "limited",
"scope_clarity": "vague",
"evidence_strength": "weak",
"capability_aligned": false
},
"gaps_identified": [
"Insufficient detail on asset tracking capabilities",
"Missing governance and review processes",
"Limited coverage of sub-elements"
],
"strengths_identified": [
"Basic asset visibility mentioned"
],
"recommendations": [
"Provide more detailed implementation specifics",
"Consider repositioning as FACILITATES capability based on limited scope"
],
"detailed_feedback": "Validation of FULL capability claim: UNSUPPORTED (35% alignment)\n\nGAPS IDENTIFIED:\n• Insufficient detail on asset tracking capabilities\n• Missing governance and review processes\n• Limited coverage of sub-elements\n\nASSESSMENT: The vendor's supporting evidence does not adequately support their FULL capability claim. Consider FACILITATES role instead."
}
| Tool | Description |
|---|---|
validate_vendor_mapping | PRIMARY Validate vendor's claimed capability role against supporting evidence through content analysis |
analyze_vendor_response | Determine vendor tool capability role for specific safeguard |
get_safeguard_details | Get detailed safeguard breakdown |
list_available_safeguards | List all available CIS safeguards |
[
{
"name": "VendorName",
"safeguard_id": "5.1",
"response": "Vendor response text..."
}
]
vendor,safeguard,response
VendorName,5.1,"Response text..."
Vendor: VendorName - Safeguard: 5.1
Response text here...
Vendor: AnotherVendor - Safeguard: 6.3
Another response...
The validate_vendor_mapping tool provides evidence-based validation of vendor capability claims. This addresses a critical need: vendors often self-assess their capabilities, but practitioners need to verify whether the supporting evidence actually justifies the claimed mapping.
| Capability | Requirements | Validation Thresholds |
|---|---|---|
| FULL | Complete implementation within scope | ≥70% core requirements + ≥40% sub-elements |
| PARTIAL | Limited scope with clear boundaries | ≥30% core requirements OR some core + ≥20% sub-elements |
| FACILITATES | Enables/enhances implementation | Facilitation language present, no direct implementation claims |
| GOVERNANCE | Policy/process management | ≥60% governance elements + policy language |
| VALIDATES | Evidence collection & reporting | Audit/monitoring/reporting capabilities present |
APPROACH: The validation tool uses comprehensive content analysis to assess capability claims:
| Analysis Dimension | Description | Assessment Focus |
|---|---|---|
| Core Requirements Coverage | Alignment with primary safeguard elements | Direct implementation language and specific capabilities |
| Sub-Elements Coverage | Support for detailed safeguard components | Breadth of coverage across safeguard sub-requirements |
| Governance Alignment | Policy/process management elements | Governance language and oversight capabilities |
| Implementation Depth | Specificity and detail of implementation | Technical depth and implementation specifics |
| Language Consistency | Alignment between claim and evidence | Consistency between stated capability and supporting text |
Content Analysis Logic: Evidence is evaluated across multiple dimensions:
# Validate a FULL coverage claim with strong evidence
claude-code "Use validate_vendor_mapping for vendor 'AssetMax Pro', safeguard '1.1', claimed capability 'full', with supporting text: 'Our platform provides comprehensive automated discovery, detailed inventory management, and complete asset lifecycle tracking for all enterprise devices including servers, workstations, and network equipment.'"
# Validate a FACILITATES claim
claude-code "Use validate_vendor_mapping for vendor 'ThreatIntel Feed', safeguard '1.1', claimed capability 'facilitates', with supporting text: 'Our threat intelligence service provides supplemental risk data that enriches existing asset management systems, enabling organizations to prioritize asset security based on threat exposure.'"
# Partial capability claim with clear scope limitations
claude-code "Use validate_vendor_mapping for vendor 'NetworkScanner Pro', safeguard '1.1', claimed capability 'partial', with supporting text: 'Our scanner provides comprehensive network device discovery and maintains detailed hardware inventories, but is limited to network-accessible devices and does not track software installations or offline systems.'"
# Insufficient evidence example
claude-code "Use validate_vendor_mapping for vendor 'BasicTracker', safeguard '1.1', claimed capability 'full', with supporting text: 'We help track computers and provide some visibility into your IT environment.'"
Complete CIS Controls v8.1 Framework Implementation
git clone https://github.com/therealcybermattlee/FrameworkMCP.git
cd FrameworkMCP
npm install
npm run build
Edit src/core/safeguard-manager.ts and add to the initializeSafeguards() method:
"X.Y": {
id: "X.Y",
title: "Safeguard Title",
description: "Description...",
implementationGroup: "IG1",
governanceElements: [...], // Orange - MUST be met
coreRequirements: [...], // Green - The "what"
subTaxonomicalElements: [...], // Yellow - Sub-elements
implementationSuggestions: [...], // Gray - Suggestions
// ...
}
npm test
git checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)Permission denied:
chmod +x dist/index.js
Module not found:
npm install
npm run build
MCP server not connecting:
This project is licensed under the Creative Commons Attribution 4.0 International License by Cyber RISE, Inc - see the LICENSE file for details.
You are free to:
Under the following terms:
Built with ❤️ for the cybersecurity community by Matt Lee
FAQs
Dual-architecture server (MCP + HTTP API) for determining vendor tool capability roles against CIS Controls Framework. Supports Microsoft Copilot custom connectors and DigitalOcean App Services deployment.
The npm package framework-mcp receives a total of 17 weekly downloads. As such, framework-mcp popularity was classified as not popular.
We found that framework-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket Fix 2.0 brings targeted CVE remediation, smarter upgrade planning, and broader ecosystem support to help developers get to zero alerts.
Security News
Socket CEO Feross Aboukhadijeh joins Risky Business Weekly to unpack recent npm phishing attacks, their limited impact, and the risks if attackers get smarter.
Product
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.