servers / app-scfcontrolsplatform-mcp-server-scf

app.scfcontrolsplatform/mcp-server-scf

communitystdiolocaldestructive capablehealthy

MCP server for the SCF Controls Platform — 72 tools for controls, evidence, risk, and TPRM.

Is it safe?Setup guide Alternatives Claim this server

01Tools · 89

How to read this: tool names here are observed from a live tools/list handshake. The Risk label is a heuristic inferred from the tool name (write/destructive verbs), not from executing the tool — a conservative guess, not a verified capability. We never escalate risk from a description. Found one that's wrong? Tell us — we fix on report.

Tool	Risk	Side effects	Approval
scf_get_evidence_item_maturity Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state.	read	false	unknown
scf_create_risk Create a new risk assessment in the risk register (write — editor+ role). Likelihood and impact scores populate the 5×5 risk matrix.	write	true	unknown
scf_get_capability_theme Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage.	read	false	unknown
scf_trigger_dpsia Queue a Data Protection Security Impact Assessment (DPSIA) for a vendor (write — editor+ role, async). Scores posture against CIA triad and certification requirements.	unknown	unknown	unknown
scf_list_system_catalog List system-catalog templates — the platform's knowledge base of known vendors/tools (slug, vendor, type, recipe maturity levels). Optionally search by name.	read	false	unknown
scf_list_assessment_objectives List SCF assessment objectives — the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination.	read	false	unknown
scf_list_vendors List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated.	read	false	unknown
scf_get_system_catalog_template Get one system-catalog template by slug with full detail: aliases and curated evidence-collection recipes (maturity level, steps, frequency, estimated time).	read	false	unknown
scf_list_domains List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control).	read	false	unknown
scf_list_webhooks List the organization's webhook endpoints (newest first). Returns name, status, delivery count, and secret prefix.	read	false	unknown
scf_get_evidence_health Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary.	read	false	unknown
scf_list_custom_risks List the organization's custom risk definitions — org-defined risks alongside the static SCF catalog, carrying auto-generated R-ORG-N codes.	read	false	unknown
scf_get_risk_matrix Get the 5×5 risk matrix data for the organization — risk distribution across likelihood × impact, ready for visualization.	read	false	unknown
scf_get_organization Get one organization's detail: subscription tier, member count, usage limits, and settings.	read	false	unknown
scf_list_evidence_files List all files uploaded or ingested for an evidence item. Returns filename, content type, upload timestamp, validation status, and a pre-signed download URL (15-min expiry).	read	false	unknown
scf_create_evidence Create an evidence tracking record from a catalog evidence ID (write — editor+ role). Starts tracking an evidence item for the organization.	write	true	unknown
scf_list_frameworks List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names.	read	false	unknown
scf_list_vendor_assessments List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record.	read	false	unknown
scf_list_capabilities List an organization's capabilities. Capabilities map to systems and evidence, showing what security functions the infrastructure supports.	read	false	unknown
scf_get_control_assessment_composite Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async).	read	false	unknown
scf_get_evidence_upgrade_recommendations Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions — the same guidance shown in the platform UI.	read	false	unknown
scf_update_evidence Upsert an evidence item's tracking fields (write — editor+ role). Creates the tracking row if missing. All body fields are optional; only provided fields are applied.	write	true	unknown
scf_get_risk_summary Get the organization's aggregate risk summary: totals by severity, treatment status breakdown, and trend data.	read	false	unknown
scf_delete_custom_risk Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible.	destructive	true	true
scf_get_risk Get one risk assessment in detail: likelihood, inherent and residual impact scores, treatment plan, owner, and review date.	read	false	unknown
scf_get_work_queue Get the caller's work queue: prioritized pending tasks, assignments, and action items across every organization they belong to.	read	false	unknown
scf_get_evidence_maturity Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities.	read	false	unknown
scf_get_evidence_assessment Get the AI assessment for an evidence file: status, relevance score (0–100), structured findings, summary, and audit metadata (model, tokens, cost). Poll after scf_trigger_evidence_assessment.	read	false	unknown
scf_list_window_assessments List recent windowed AI assessments for an evidence item (newest first). Each entry includes window bounds, frequency, file IDs, coverage, status, relevance score, findings, and cost.	read	false	unknown
scf_list_risks List risk assessments in the organization's risk register. Returns each risk's likelihood, impact, treatment status, and linked controls.	read	false	unknown
scf_list_custom_risk_controls List controls linked to a custom risk. Returns `catalog_control_ids` plus `scoped_controls` with implementation status — same shape as the built-in controls-for-risk endpoint.	read	false	unknown
scf_create_system Create a system in the organization's infrastructure inventory (write — editor+ role). Systems can be linked to capabilities and evidence.	write	true	unknown
scf_create_vendor Create a vendor in the TPRM registry (write — editor+ role). Platform auto-scores risk based on criticality and data handling.	write	true	unknown
scf_trigger_vendor_assessment Queue an AI vendor security assessment (write — editor+ role, async, HTTP 202). Replaces the deprecated DPSIA trigger. Returns assessment_id + job_id; poll scf_get_vendor_assessment_status.	read	false	unknown
scf_update_system Update an existing system record (write — editor+ role). All fields are optional; only provided fields are applied.	write	true	unknown
scf_list_capability_theme_controls List SCF controls mapped to a capability theme (KSI), with scoping status, implementation status, and maturity level. Supports pagination and scope filtering — ideal for KSI drill-down.	read	false	unknown
scf_list_webhook_deliveries List delivery logs for a webhook endpoint (newest first). Each entry shows signature validation result, processing status, evidence ID, and timestamps.	read	false	unknown
scf_remove_custom_risk_control Unlink a scoped control from a custom risk (write — editor+ role). The control and risk both remain; only the mapping is removed.	destructive	true	true
scf_get_recipe_generation_status Get the status of a queued AI recipe-generation job for a system. Poll this after scf_generate_system_recipes.	read	false	unknown
scf_get_scoped_control Get one scoped control in detail: owner, implementation notes, evidence links, and audit history. Identify by scf_id, not by UUID.	read	false	unknown
scf_list_evidence_catalog List evidence items from the SCF reference catalog — the 272 standard evidence types that can be collected to demonstrate control implementation. Supports free-text search and pagination.	read	false	unknown
scf_add_custom_risk_control Link a scoped control to a custom risk (write — editor+ role). The control must already be scoped (in-scope) for this organization.	write	true	unknown
scf_list_organizations List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need.	read	false	unknown
scf_list_systems List the organization's infrastructure systems — the tools and platforms that implement security capabilities. Optionally filter by linked vendor.	read	false	unknown
scf_get_evidence_suggestions Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance.	read	false	unknown
scf_list_evidence_gaps List the organization's evidence coverage gaps: evidence required by in-scope controls that is not yet tracked, with overall coverage percentage.	read	false	unknown
scf_rotate_webhook_secret Rotate the HMAC signing secret for a webhook endpoint (write — admin role). The old secret is invalidated immediately. Returns the new plaintext secret exactly once.	read	false	unknown
scf_get_vendor_research Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research.	read	false	unknown
scf_get_vendor_assessment Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources.	read	false	unknown
scf_get_evidence_assessment_summary Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents.	read	false	unknown
scf_scope_framework Bulk-scope every control mapped to a framework into the organization (write — editor+ role). Creates a scoped-control entry for each control in the framework.	unknown	unknown	unknown
scf_get_vendor Get one vendor's detail: certifications, assessments, computed risk score, and latest research results.	read	false	unknown
scf_get_audit_log Get one organization's audit trail: field-level changes to controls, evidence, and related entities, with actor, timestamp, and before/after values.	read	false	unknown
scf_get_control Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog.	read	false	unknown
scf_get_scoping_stats Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown.	read	false	unknown
scf_get_evidence_validation Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp.	read	false	unknown
scf_revalidate_evidence_file Re-run the validation engine against an evidence file (write — editor+ role). Checks catalog existence, content type, field coverage, freshness, storage. Returns the updated result.	read	false	unknown
scf_get_vendor_assessment_status Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment.	read	false	unknown
scf_get_window_assessment_summary Get aggregate windowed-assessment metrics for the organization dashboard: total windows assessed, counts by status (including `insufficient_sample`), average relevance score, and total cost in cents.	read	false	unknown
scf_get_notifications Get the caller's notifications: new assignments, comments, status changes, and system alerts.	read	false	unknown
scf_list_controls List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search.	read	false	unknown
scf_batch_update_controls Batch-update up to 500 scoped controls in one transaction (write — editor+ role). Each operation identifies its target by scf_id; status values are lowercase.	write	true	unknown
scf_get_evidence_validation_summary Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate.	read	false	unknown
scf_trigger_evidence_assessment Queue an AI assessment of a single evidence file (write — editor+ role, async). Returns a pending record; poll scf_get_evidence_assessment until status is sufficient/partial/insufficient.	read	false	unknown
scf_list_evidence_tasks List evidence collection tasks — the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.	read	false	unknown
scf_trigger_vendor_research Queue AI security research for a vendor (write — editor+ role, async). Checks HIBP breach data, NVD vulnerabilities, and public posture. Returns a task ID; poll scf_get_vendor_research.	read	false	unknown
scf_bulk_assess_evidence Queue AI assessments for multiple evidence files (write — editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued.	read	false	unknown
scf_create_custom_risk Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record.	write	true	unknown
scf_trigger_window_assessment Queue a windowed AI assessment that scores every file in the evidence item's frequency window as one portfolio (write — editor+ role, async). Returns 422 if tracking or frequency is missing.	read	false	unknown
scf_get_latest_vendor_assessment Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet.	read	false	unknown
scf_update_vendor Update an existing vendor record (write — editor+ role). Only provided fields are applied.	write	true	unknown
scf_get_current_user Get the authenticated caller's profile: name, email, organization memberships, and per-org role.	read	false	unknown
scf_list_capability_themes List an organization's 11 KSI capability themes. Themes group NIST 800-53 controls into security capability areas for a high-level posture view.	read	false	unknown
scf_create_webhook Create a webhook endpoint for evidence-inbox ingestion (write — admin role). Returns the plaintext HMAC signing secret exactly once — store it immediately; it cannot be retrieved later.	write	true	unknown
scf_get_capability_theme_scorecard Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands.	read	false	unknown
scf_generate_system_recipes Queue AI generation of evidence-collection recipes for a system (write — editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress.	unknown	unknown	unknown
scf_list_scoped_controls List controls scoped to the organization with implementation status. Filter by scope status, domain, framework, CSF function, weighting, or free-text search. Paginated.	read	false	unknown
scf_bulk_assess_windows Queue windowed AI assessments for up to 25 evidence IDs (write — editor+ role, async). Items without tracking or a frequency set are reported under `skipped_detail` in the response.	unknown	unknown	unknown
scf_update_scoped_control Update a scoped control's implementation fields (write — editor+ role). Identify by scf_id, not UUID. Only provided fields are applied.	write	true	unknown
scf_list_evidence List evidence items tracked against an organization's controls. Returns each item's tracking status, maturity level, and linked controls. Optionally filter by system.	read	false	unknown
scf_get_evidence_file Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact.	read	false	unknown
scf_get_window_assessment Get one windowed AI assessment by ID. Returns full detail: window bounds, frequency, file IDs, coverage, expected artifact types, status, relevance score, findings, summary, hashes, tokens, cost.	read	false	unknown
scf_list_control_assessment_composites List rolled-up assessment composites for the org. Cursor-paginated, worst-band first (insufficient → sufficient). Filter by status/domain/computation_version. Pass next_cursor to page forward.	read	false	unknown
scf_update_custom_risk Update a custom risk definition's metadata — title, description, category (write — editor+ role). Only provided fields are applied.	write	true	unknown
scf_get_capability_theme_evidence_posture Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards.	read	false	unknown
scf_delete_webhook Revoke a webhook endpoint — soft-delete that marks it inactive (destructive write — admin role). Future deliveries return 403; the record remains for audit.	destructive	true	true
scf_list_members List members of one organization with their role (admin, editor, or viewer).	read	false	unknown
scf_get_webhook Get one webhook endpoint's detail: delivery stats, allowed evidence IDs, and rate-limit configuration.	read	false	unknown
scf_get_system_recipes Get evidence-collection recipes for a system, matched via its catalog template, alias, or fallback. Returns matched_via, the template summary, and per-maturity-level recipe steps.	read	false	unknown

02Install & source

npx -y mcp-server-scf

npx

docker run markac007/mcp-server-scf

docker

repohttps://github.com/MarkAC007/mcp-server-scf
licenseMIT
adoption2 stars · 0 forks

03Access granted

Read email · writeWorkflow automation · destructive

The access this server can exercise, inferred from its verified tools — not a declared OAuth scope.

05Provenance & freshness

sourcesOfficial MCP Registry [p1]

last_checked2026-08-22 15:24Z

next_check2026-08-22 18:24Z

cadenceevery 3h

verifiedhandshake:failed metadata:passed metadata:passed metadata:passed metadata:passed handshake:failed metadata:passed handshake:failed metadata:passed handshake:failed

index_statusindex — 9 unique facts >= 5

06Badge

Add the “as seen on MCPExplorer” badge to your README.

[![app.scfcontrolsplatform/mcp-server-scf MCP — as seen on mcpexplorer.com](https://mcpexplorer.com/badge/app-scfcontrolsplatform-mcp-server-scf.svg)](https://mcpexplorer.com/servers/app-scfcontrolsplatform-mcp-server-scf)

Next step

This is one server. A loadout combines the right servers, governance, and proven plays for a whole job — assembled deliberately, not tool-dumped.

Explore loadouts →