security-controls-mcp
Advanced tools
MCP server for querying security framework controls (SCF) - map between ISO 27001, NIST CSF, DORA, PCI DSS, and more
THE definitive MCP server for security framework mapping. Makes 1,451 security controls across 262 SCF-mapped frameworks searchable and AI-accessible through Claude, Cursor, or any MCP-compatible client.
Built on the Secure Controls Framework (SCF) by ComplianceForge.
Key capabilities:
Different frameworks describe the same security measures in different ways. ISO 27001 has one control ID, NIST CSF has another, PCI DSS has yet another — but they're all talking about the same thing.
This MCP server provides instant bidirectional mapping between any two frameworks via the SCF rosetta stone. Ask Claude "What DORA controls does ISO 27001 A.5.15 map to?" and get an immediate answer backed by ComplianceForge's framework database.
Connect directly to the hosted version — zero dependencies, nothing to install.
Endpoint: https://security-controls-mcp.vercel.app/mcp
| Client | How to Connect |
|---|---|
| Claude.ai | Settings > Connectors > Add Integration > paste URL |
| Claude Code | claude mcp add security-controls --transport http https://security-controls-mcp.vercel.app/mcp |
| Claude Desktop | Add to config (see below) |
| GitHub Copilot | Add to VS Code settings (see below) |
Claude Desktop — add to claude_desktop_config.json:
{
"mcpServers": {
"security-controls": {
"type": "url",
"url": "https://security-controls-mcp.vercel.app/mcp"
}
}
}
GitHub Copilot — add to VS Code settings.json:
{
"github.copilot.chat.mcp.servers": {
"security-controls": {
"type": "http",
"url": "https://security-controls-mcp.vercel.app/mcp"
}
}
}
pipx install security-controls-mcp
Claude Desktop — add to claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"security-controls": {
"command": "scf-mcp"
}
}
}
macOS users: Use the full path (GUI apps don't inherit shell PATH):
{
"mcpServers": {
"security-controls": {
"command": "/Users/YOUR_USERNAME/.local/bin/scf-mcp"
}
}
}
Find your path with: which scf-mcp
Cursor / VS Code:
{
"mcp.servers": {
"security-controls": {
"command": "scf-mcp"
}
}
}
See docs/coverage.md for the complete list of 262 SCF-mapped frameworks.
version_info() - Get server version, statistics, and top frameworks
list_frameworks() - List all 262 SCF-mapped frameworks with control counts
get_control(control_id) - Get full details for a specific SCF control
search_controls(query, frameworks=[], limit=10) - Search controls by keyword
get_framework_controls(framework) - Get all controls for a specific framework
map_frameworks(source_framework, target_framework, source_control=None) - Map between frameworks
list_available_standards() - List all available standards (SCF + bundled public profiles + imported)
query_standard(standard, query, limit=10) - Search within a bundled public profile or purchased standard
get_clause(standard, clause_id) - Get a specific clause or section
These profiles are available immediately after install and are sourced from official public publications:
netherlands_bio - Netherlands BIO2finland_katakri - Finland KATAKRI 2020norway_nsm - Norway NSM Basic Principles for ICT Securitysweden_msb - Sweden MSB information security and incident reporting profiledenmark_cfcs - Denmark CFCS cyber defence profilebelgium_ccb - Belgium CyberFundamentals (CyFun)france_anssi - France ANSSI cyber hygiene baselineSee PAID_STANDARDS_GUIDE.md for import instructions.
Import your purchased ISO 27001, NIST SP 800-53, or other standards to get official text alongside SCF descriptions:
# Install import tools
pip install security-controls-mcp[import-tools]
# Import purchased PDF
scf-mcp-import import-standard \
--file ~/Downloads/ISO-27001-2022.pdf \
--type iso_27001_2022 \
--title "ISO/IEC 27001:2022"
# Restart MCP, then query
Your paid content stays private in ~/.security-controls-mcp/ (never committed to git).
Full guide: PAID_STANDARDS_GUIDE.md
Data Pipeline: SCF JSON → In-memory index → MCP tools → AI response
Key principles:
Data integrity:
Based on SCF 2025.4 (released December 29, 2025)
Included data files:
scf-controls.json - All 1,451 controls with framework mappingsframework-to-scf.json - Reverse index for framework-to-SCF lookupsPart of Ansvar's Compliance Suite - MCP servers that work together for end-to-end compliance:
EU Regulations MCP - Query 47 EU regulations (GDPR, AI Act, DORA, NIS2, etc.)
npx @ansvar/eu-regulations-mcpUS Regulations MCP - Query US federal and state compliance laws (HIPAA, CCPA, SOX, etc.)
npm install @ansvar/us-regulations-mcpOT Security MCP - Query IEC 62443, NIST 800-82/53, MITRE ATT&CK for ICS
npm install @ansvar/ot-security-mcp1. "What DORA requirements apply to ICT risk management?"
→ EU Regulations MCP returns Article 6 full text
2. "What security controls satisfy DORA Article 6?"
→ Security Controls MCP maps to ISO 27001, NIST CSF controls
3. "Show me ISO 27001 A.8.1 implementation details"
→ Security Controls MCP returns control requirements
This repository uses a dev integration branch. Do not push directly to main.
feature-branch → PR to dev → verify on dev → PR to main → deploy
main is production-ready. Only receives merges from dev via PR.dev is the integration branch. All changes land here first.dev.# Clone and install
git clone https://github.com/Ansvar-Systems/security-controls-mcp.git
cd security-controls-mcp
pip install -e '.[dev]'
# Install pre-commit hooks
pre-commit install
# Run tests
pytest tests/ -v
Pre-commit hooks run automatically before each commit:
Bypass hooks (emergencies only): git commit --no-verify
Not Legal or Compliance Advice: Control text is sourced directly from official SCF data, but this tool should not be used as the sole basis for compliance decisions. Always verify against official framework sources and consult qualified compliance professionals.
AI Content Restrictions: The SCF license explicitly prohibits using AI systems to generate derivative content such as policies, standards, procedures, metrics, risks, or threats based on SCF data. You may query and analyze controls, but not generate derivative compliance artifacts.
Purchased Standards: Optional standards imports require valid licenses. You must own legitimate copies and comply with copyright restrictions. This tool does not include or distribute any copyrighted standards text.
Framework Coverage: While SCF provides comprehensive mappings, not all controls map 1:1 across frameworks. Always review official framework documentation for authoritative requirements.
Code: Apache License 2.0 (see LICENSE)
Data: Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0) by ComplianceForge
What you MAY do:
What you MAY NOT do:
For complete terms: SCF Terms & Conditions
We maintain a family of MCP servers for compliance and security professionals:
| Server | Description | Install |
|---|---|---|
| EU Regulations | 47 EU regulations (GDPR, AI Act, DORA, NIS2, MiFID II, eIDAS, MDR...) | npx @ansvar/eu-regulations-mcp |
| US Regulations | HIPAA, CCPA, SOX, GLBA, FERPA, COPPA, FDA 21 CFR Part 11, state privacy laws | npx @ansvar/us-regulations-mcp |
| OT Security | IEC 62443, NIST 800-82, MITRE ATT&CK for ICS | npx @ansvar/ot-security-mcp |
| Automotive | UNECE R155/R156, ISO 21434 for automotive cybersecurity | npx @ansvar/automotive-cybersecurity-mcp |
| Sanctions | Offline sanctions screening with OpenSanctions (30+ lists) | pip install ansvar-sanctions-mcp |
Browse all projects: ansvar.eu/open-source
Built by: Ansvar Systems (Stockholm, Sweden)
FAQs
MCP server for querying security framework controls (SCF) - map between ISO 27001, NIST CSF, DORA, PCI DSS, and more
The pypi package security-controls-mcp receives a total of 267 weekly downloads. As such, security-controls-mcp popularity was classified as not popular.
We found that security-controls-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A new federal program will let vetted U.S. cybersecurity firms help investigate and disrupt foreign cybercrime groups under government direction.
Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.