# Fedramp Docs Mcp

> MCP Documentation Server Using the Official FedRAMP/docs Repo

- **Type:** MCP server
- **Install:** `agentstack add mcp-hackidle-fedramp-docs-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [hackIDLE](https://agentstack.voostack.com/s/hackidle)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [hackIDLE](https://github.com/hackIDLE)
- **Source:** https://github.com/hackIDLE/fedramp-docs-mcp

## Install

```sh
agentstack add mcp-hackidle-fedramp-docs-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# FedRAMP Docs MCP Server

> ## ⚠️ This project is sunsetting
>
> This MCP server is no longer under active development. The FedRAMP search and FRMR parsing capabilities are being folded into **[GRC Clanker](https://github.com/hackIDLE/grclanker)** and **[myctrl.tools](https://myctrl.tools)**, where they live inside an actual GRC workflow instead of as a standalone subprocess.
>
> The npm package and this repository remain available for existing users, but no new features will land here. For the reasoning and post-mortem, see the [project writeup](https://ethantroy.dev/projects/ai-ml/fedramp-docs-mcp/).
>
> — Ethan (2026-04-15)

---

[](https://github.com/hackIDLE/fedramp-docs-mcp/actions/workflows/mcp-scan.yml)

> **Disclaimer:** This is an unofficial, community project and is not affiliated with, endorsed by, or associated with FedRAMP or the U.S. federal government. The author is not officially affiliated with FedRAMP. The FedRAMP name and any related marks are property of their respective owners.

Custom Model Context Protocol (MCP) server that makes the FedRAMP/docs repository queryable with FRMR-aware tooling. The server scans FRMR JSON datasets and supporting markdown guidance, exposes structured tools for analysis, and can optionally clone and cache the upstream repository for you.

## Demo

See the FedRAMP Docs MCP Server in action with Claude Desktop:

https://github.com/user-attachments/assets/653c3956-0bfb-46c4-9e72-8a6d75e3a80d

## Documentation

| Resource | Description |
|----------|-------------|
| [**Quick Start Guide**](QUICKSTART.md) | Get running in under 5 minutes |
| [**Full Documentation**](docs/README.md) | Complete guides and reference |
| [**MCP Client Setup**](docs/guides/mcp-clients.md) | Configure Claude Desktop, Cursor, VS Code |
| [**Tools Reference**](docs/reference/tools.md) | All 21 MCP tools with parameters |
| [**Troubleshooting**](docs/guides/troubleshooting.md) | Common issues and solutions |

**Additional resources:**
- [Local Development](docs/setup/local-development.md) - Build from source
- [Docker Setup](docs/setup/docker.md) - Container deployment
- [Security Hardening](docs/setup/security-hardening.md) - Production configurations
- [Contributing](docs/contributing.md) - How to contribute

## Prerequisites

- Node.js 18 or higher
- npm 8 or higher

## Features

- Auto-detects all 12 FRMR JSON document types and builds typed metadata.
- Extracts KSI entries, flattened control mappings, and Significant Change references.
- Fast markdown search via an inverted index backed by Lunr with snippets and line numbers.
- Indexes 62+ markdown files from `tools/site/content/` (Zensical static site content).
- Structured diffing between FRMR versions, including per-item change detection.
- Health check, version listing, and curated Significant Change guidance aggregator.
- **Claude Plugin** with slash commands, agent skills, and compliance analyst agent.
- **Docker support** with security hardening following 2025 best practices.

### Supported Document Types

| Type | Full Name |
|------|-----------|
| KSI | Key Security Indicators |
| MAS | Minimum Assessment Scope |
| VDR | Vulnerability Detection and Response |
| SCN | Significant Change Notifications |
| FRD | FedRAMP Definitions |
| ADS | Authorization Data Sharing |
| CCM | Collaborative Continuous Monitoring |
| FSI | FedRAMP Security Inbox |
| ICP | Incident Communications Procedures |
| PVA | Persistent Validation and Assessment |
| SCG | Secure Configuration Guide |
| UCM | Using Cryptographic Modules |

## Getting Started

### Local Development

1. Install dependencies:
```bash
npm install
```

2. Build the project:
```bash
npm run build
```

3. Run the server:
```bash
node dist/index.js
```

### Global Installation

To install globally and use the `fedramp-docs-mcp` command:

```bash
npm install -g .
fedramp-docs-mcp
```

**Note:** Global installation is required if you want to use `fedramp-docs-mcp` as the command in MCP client configurations (Claude Desktop, Goose, etc.). Alternatively, you can use the full path to the built server: `node /path/to/fedramp-docs-mcp/dist/index.js`

### CLI Commands

The package includes helpful CLI commands:

```bash
# Show help and usage information
npx fedramp-docs-mcp help

# Install Claude Code plugin
npx fedramp-docs-mcp setup

# Print MCP server configuration for Claude Desktop/Code
npx fedramp-docs-mcp mcp-config

# Start MCP server (used by MCP clients)
npx fedramp-docs-mcp
```

During startup the server ensures a FedRAMP/docs repository is available, indexes FRMR JSON and markdown content, then begins serving requests on MCP stdio.

## Configuration

Environment variables control repository discovery and indexing behaviour:

| Variable | Default | Description |
| --- | --- | --- |
| `FEDRAMP_DOCS_PATH` | `~/.cache/fedramp-docs` | Path to an existing FedRAMP/docs checkout. |
| `FEDRAMP_DOCS_REMOTE` | `https://github.com/FedRAMP/docs` | Remote used when cloning. |
| `FEDRAMP_DOCS_BRANCH` | `main` | Branch to checkout when cloning. |
| `FEDRAMP_DOCS_ALLOW_AUTO_CLONE` | `true` | Clone automatically when the path is missing. |
| `FEDRAMP_DOCS_AUTO_UPDATE` | `true` | Automatically check for and fetch repository updates. |
| `FEDRAMP_DOCS_UPDATE_CHECK_HOURS` | `24` | Hours between automatic update checks (when auto-update is enabled). |
| `FEDRAMP_DOCS_INDEX_PERSIST` | `true` | Persist the in-memory index under `~/.cache/fedramp-docs/index-v1.json`. |

Set `FEDRAMP_DOCS_PATH` if you maintain a local clone. Otherwise leave it unset and allow the server to create a shallow cached copy.

### Keeping Data Up-to-Date

The server includes automatic update checking to keep the FedRAMP docs current:

**Automatic Updates (Default Behavior):**
- Every 24 hours (configurable), the server checks if the cached repository needs updating
- If updates are available, they're fetched automatically on server startup
- This ensures you always have recent FedRAMP data without manual intervention

**Manual Updates:**
- Use the `update_repository` tool to force an immediate update
- Example query in Claude Desktop: "Update the FedRAMP docs repository"
- Useful when you know new requirements or guidance has been published

**Disabling Auto-Update:**
```json
{
  "mcpServers": {
    "fedramp-docs": {
      "command": "fedramp-docs-mcp",
      "env": {
        "FEDRAMP_DOCS_AUTO_UPDATE": "false"
      }
    }
  }
}
```

**Custom Update Frequency (check every 6 hours):**
```json
{
  "mcpServers": {
    "fedramp-docs": {
      "command": "fedramp-docs-mcp",
      "env": {
        "FEDRAMP_DOCS_UPDATE_CHECK_HOURS": "6"
      }
    }
  }
}
```

## Available Tools

The server provides 21 tools organized into categories. All tools follow the error model and respond with JSON payloads.

### Document Discovery
| Tool | Description |
|------|-------------|
| `list_frmr_documents` | Enumerate indexed FRMR JSON documents |
| `get_frmr_document` | Return full JSON and summary for a document |
| `list_versions` | Collate version metadata by FRMR document type |

### KSI (Key Security Indicators)
| Tool | Description |
|------|-------------|
| `list_ksi` | Filter and inspect Key Security Indicators |
| `get_ksi` | Get a specific KSI item by ID |
| `filter_by_impact` | Filter KSI items by impact level (low/moderate/high) |
| `get_theme_summary` | Get comprehensive guidance for a KSI theme (IAM, CNA, etc.) |
| `get_evidence_examples` | Get automation-friendly evidence suggestions for KSI compliance (community suggestions, not official FedRAMP) |

### Control Mapping
| Tool | Description |
|------|-------------|
| `list_controls` | Flatten FRMR → control mappings |
| `get_control_requirements` | Get all requirements mapped to a specific control |
| `analyze_control_coverage` | Report which control families have FedRAMP requirements |

### Search & Lookup
| Tool | Description |
|------|-------------|
| `search_markdown` | Full-text search across documentation |
| `read_markdown` | Read specific markdown file contents |
| `search_definitions` | Search FedRAMP definitions (FRD) by term |
| `get_requirement_by_id` | Get any FRMR requirement by ID (KSI-*, FRR-*, FRD-*) |

### Analysis
| Tool | Description |
|------|-------------|
| `diff_frmr` | Structured diff of two FRMR datasets |
| `grep_controls_in_markdown` | Locate control references in markdown |
| `get_significant_change_guidance` | Curated Significant Change references |

### System
| Tool | Description |
|------|-------------|
| `search_tools` | Search and discover available tools by keyword or category |
| `health_check` | Confirm the server indexed successfully |
| `update_repository` | Force update the cached FedRAMP docs |

## Evidence Collection Suggestions

The `get_evidence_examples` tool provides **community-suggested** evidence examples for each KSI. These are automation-friendly suggestions showing how to programmatically collect compliance evidence via APIs, CLI commands, and security tools.

**Important:** These are NOT official FedRAMP guidance. Always verify requirements with [official FedRAMP documentation](https://fedramp.gov).

### What's Included

For each of the 72 KSI indicators, we provide:
- **Evidence types**: API calls, reports, scans, logs, configurations, documentation
- **Automation sources**: AWS, Azure, GCP, Okta, Splunk, Terraform, GitHub Actions, etc.
- **Example commands**: Ready-to-use CLI commands and API endpoints

### Example Evidence Sources by Theme

| Theme | Example Sources |
|-------|----------------|
| **IAM** | Okta/Entra MFA policies, AWS IAM credential reports, PAM tools (CyberArk, Vault) |
| **CNA** | AWS Security Groups, VPC Flow Logs, Container scans (Trivy), CSPM (Wiz, Prisma) |
| **MLA** | SIEM config (Splunk, Sentinel), CloudTrail, IaC scans (Checkov, tfsec) |
| **CMT** | Git history, CI/CD pipelines (GitHub Actions), Change tickets (ServiceNow, Jira) |
| **SVC** | TLS scans (SSL Labs), Secrets Manager rotation, Patch compliance (SSM) |
| **INR** | PagerDuty incidents, Post-mortems (Blameless), ServiceNow tickets |
| **RPL** | AWS Backup reports, DR test logs, Chaos engineering results |
| **TPR** | Vendor ratings (SecurityScorecard), Dependency scans (Dependabot, Snyk) |

### Usage Example

```
"What evidence do I need for KSI-IAM-01 (Phishing-Resistant MFA)?"
→ Returns suggested API calls, CLI commands, and artifacts to collect

"Get evidence checklist for the CNA theme"
→ Returns automation sources for all Cloud Native Architecture indicators
```

See `src/tools/` for the precise schemas implemented with Zod. Each tool returns either a successful object or an `error` payload containing `code`, `message`, and optional `hint`.

### Usage Examples

When using the MCP server with Claude Desktop or other MCP clients, here are some example queries:

**Getting KSI Information:**
```
"List all available FedRAMP documents"
→ Uses list_frmr_documents

"Show me all KSI items for moderate impact systems"
→ Uses filter_by_impact with impact='moderate'

"Give me a summary of the IAM theme requirements"
→ Uses get_theme_summary with theme='IAM'

"What evidence do I need for IAM compliance?"
→ Uses get_evidence_examples with theme='IAM'
```

**Searching Documentation:**
```
"Search for information about continuous monitoring"
→ Uses search_markdown with query 'continuous monitoring'

"What does 'federal customer data' mean in FedRAMP?"
→ Uses search_definitions with term='federal customer data'

"Get the details for requirement KSI-IAM-01"
→ Uses get_requirement_by_id with id='KSI-IAM-01'
```

**Working with Controls:**
```
"What FedRAMP requirements map to control AY-01?"
→ Uses get_control_requirements with control='AY-01'

"Which control families have the most FedRAMP coverage?"
→ Uses analyze_control_coverage

"Find all markdown files that reference AC-2"
→ Uses grep_controls_in_markdown with control='AC-2'
```

**Analyzing Changes:**
```
"What's new in the latest KSI release?"
→ Uses list_versions then diff_frmr to compare versions

"Show significant change guidance"
→ Uses get_significant_change_guidance
```

### Advanced Queries: Dashboard & Architecture Insights

These prompts combine FedRAMP data with Claude's analytical capabilities to help you design compliance dashboards and features:

**Dashboard Architecture:**
```
"Using the FedRAMP KSI data, design a compliance dashboard architecture.
What components would I need? How should I structure the data for real-time monitoring?"

"Get all KSI themes and their indicators. Then recommend how to organize
them into a dashboard with drill-down navigation."
```

**Visualization Design:**
```
"Analyze the FedRAMP control coverage data. What would be the best
chart types to visualize control family coverage? Suggest a color
scheme for compliance status."

"List the KSIs filtered by impact level. Design a risk heat map
visualization showing low/moderate/high impact requirements."
```

**Feature Planning:**
```
"Get the evidence checklist from FedRAMP. How would you build a
feature that tracks evidence collection progress with percentage
completion per KSI theme?"

"What are the requirements for AC-2 (Account Management)? Design a
feature that helps users track their implementation status against
these requirements."
```

**Data Modeling:**
```
"Analyze the structure of KSI indicators and their control mappings.
What database schema would you recommend for a compliance tracking app?"

"Get a theme summary for IAM. How would you model the relationship
between KSIs, NIST controls, and evidence in a graph database?"
```

**Executive Reporting:**
```
"Using the control coverage analysis, design an executive summary
dashboard that shows compliance posture at a glance."

"Analyze all high-impact KSI requirements and create a prioritized
remediation roadmap template."
```

## Tool Search & Deferred Loading

With 21 tools, this MCP server is a great candidate for **deferred tool loading** (also known as tool search). Instead of loading all tools upfront, clients can load a small set of essential tools and discover the rest on demand via the `search_tools` tool.

### The `search_tools` Tool

The `search_tools` tool lets clients discover available tools by keyword or category:

```
"What tools help with KSI compliance?"
→ search_tools(query="ksi compliance")
→ Returns: list_ksi, get_ksi, filter_by_impact, get_theme_summary, get_evidence_examples

"What analysis tools are available?"
→ search_tools(category="Analysis")
→ Returns: diff_frmr, grep_controls_in_markdown, get_significant_change_guidance
```

### Recommended Non-Deferred Tools

When using deferred loading, keep these 5 tools always loaded:

| Tool | Why Always Loaded |
|------|-------------------|
| `search_tools` | Required for discovering other tools |
| `search_markdown` | Most common entry point for documentation queries |
| `list_frmr_documents` | Starting point for FRMR data exploration |
| `health_check` | Diagnostics and status verification |
| `get_requirement_by_id` | Universal ID lookup across all document types |

### Claude API Configuration with Deferred Loading

When using the Claude API with `mcp_toolset`, you can configure deferred loading:

```python
import anthropic

client = anthropic.Anthropic()

response = client.messages.create(
    model="claude-sonnet-4-20250514",
    max_tokens=1024,
    mcp_servers=[
        {
            "type": "stdio",
            "command": "fedramp-docs-mcp",
            "name": "fedramp-docs",
        }
    ],
    messages=[{"role": "user", "content": "..."}],
)
```

The Claude API will use tool annotations (`readOnlyHint`, `destructiveHint`, etc.) to make informed decisions about tool selection. All 21 tools include annotations.

## MCP Client Configuration

The FedRAMP Docs MCP server works with any MCP-compatible client. Below are setup instructions for the most popular and reliable clients.

**Recommended clients:**
- **Claude Desktop** - Most mature MCP integra

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [hackIDLE](https://github.com/hackIDLE)
- **Source:** [hackIDLE/fedramp-docs-mcp](https://github.com/hackIDLE/fedramp-docs-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-hackidle-fedramp-docs-mcp
- Seller: https://agentstack.voostack.com/s/hackidle
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.