Fedramp Docs MCP

FedRAMP Docs MCP Server

## ⚠️ This project is sunsetting

This MCP server is no longer under active development. The FedRAMP search and FRMR parsing capabilities are being folded into [GRC Clanker](https://github.com/hackIDLE/grclanker) and [myctrl.tools](https://myctrl.tools), where they live inside an actual GRC workflow instead of as a standalone subprocess.

The npm package and this repository remain available for existing users, but no new features will land here. For the reasoning and post-mortem, see the project writeup.

— Ethan (2026-04-15)

---

Disclaimer: This is an unofficial, community project and is not affiliated with, endorsed by, or associated with FedRAMP or the U.S. federal government. The author is not officially affiliated with FedRAMP. The FedRAMP name and any related marks are property of their respective owners.

Custom Model Context Protocol (MCP) server that makes the FedRAMP/docs repository queryable with FRMR-aware tooling. The server scans FRMR JSON datasets and supporting markdown guidance, exposes structured tools for analysis, and can optionally clone and cache the upstream repository for you.

Demo

See the FedRAMP Docs MCP Server in action with Claude Desktop:

https://github.com/user-attachments/assets/653c3956-0bfb-46c4-9e72-8a6d75e3a80d

Documentation

Additional resources:

• Local Development - Build from source
• Docker Setup - Container deployment
• Security Hardening - Production configurations
• Contributing - How to contribute

Prerequisites

• Node.js 18 or higher
• npm 8 or higher

Features

• Auto-detects all 12 FRMR JSON document types and builds typed metadata.
• Extracts KSI entries, flattened control mappings, and Significant Change references.
• Fast markdown search via an inverted index backed by Lunr with snippets and line numbers.
• Indexes 62+ markdown files from tools/site/content/ (Zensical static site content).
• Structured diffing between FRMR versions, including per-item change detection.
• Health check, version listing, and curated Significant Change guidance aggregator.
• Claude Plugin with slash commands, agent skills, and compliance analyst agent.
• Docker support with security hardening following 2025 best practices.

Supported Document Types

Getting Started

Local Development

1. Install dependencies:

npm install

1. Build the project:

npm run build

1. Run the server:

node dist/index.js

Global Installation

To install globally and use the fedramp-docs-mcp command:

npm install -g .

fedramp-docs-mcp

Note: Global installation is required if you want to use fedramp-docs-mcp as the command in MCP client configurations (Claude Desktop, Goose, etc.). Alternatively, you can use the full path to the built server: node /path/to/fedramp-docs-mcp/dist/index.js

CLI Commands

The package includes helpful CLI commands:

# Show help and usage information

npx fedramp-docs-mcp help

Install Claude Code plugin

npx fedramp-docs-mcp setup

Print MCP server configuration for Claude Desktop/Code

npx fedramp-docs-mcp mcp-config

Start MCP server (used by MCP clients)

npx fedramp-docs-mcp

During startup the server ensures a FedRAMP/docs repository is available, indexes FRMR JSON and markdown content, then begins serving requests on MCP stdio.

Configuration

Environment variables control repository discovery and indexing behaviour:

Set FEDRAMP_DOCS_PATH if you maintain a local clone. Otherwise leave it unset and allow the server to create a shallow cached copy.

Keeping Data Up-to-Date

The server includes automatic update checking to keep the FedRAMP docs current:

Automatic Updates (Default Behavior):

• Every 24 hours (configurable), the server checks if the cached repository needs updating
• If updates are available, they're fetched automatically on server startup
• This ensures you always have recent FedRAMP data without manual intervention

Manual Updates:

• Use the update_repository tool to force an immediate update
• Example query in Claude Desktop: "Update the FedRAMP docs repository"
• Useful when you know new requirements or guidance has been published

Disabling Auto-Update:

{

"mcpServers": { "fedramp-docs": { "command": "fedramp-docs-mcp", "env": { "FEDRAMP_DOCS_AUTO_UPDATE": "false" } } } }

Custom Update Frequency (check every 6 hours):

{

"mcpServers": { "fedramp-docs": { "command": "fedramp-docs-mcp", "env": { "FEDRAMP_DOCS_UPDATE_CHECK_HOURS": "6" } } } }

Available Tools

The server provides 21 tools organized into categories. All tools follow the error model and respond with JSON payloads.

Document Discovery

KSI (Key Security Indicators)

Control Mapping

Search & Lookup

Analysis

System

Evidence Collection Suggestions

The get_evidence_examples tool provides community-suggested evidence examples for each KSI. These are automation-friendly suggestions showing how to programmatically collect compliance evidence via APIs, CLI commands, and security tools.

Important: These are NOT official FedRAMP guidance. Always verify requirements with official FedRAMP documentation.

What's Included

For each of the 72 KSI indicators, we provide:

• Evidence types: API calls, reports, scans, logs, configurations, documentation
• Automation sources: AWS, Azure, GCP, Okta, Splunk, Terraform, GitHub Actions, etc.
• Example commands: Ready-to-use CLI commands and API endpoints

Example Evidence Sources by Theme

Usage Example

"What evidence do I need for KSI-IAM-01 (Phishing-Resistant MFA)?"

→ Returns suggested API calls, CLI commands, and artifacts to collect

"Get evidence checklist for the CNA theme" → Returns automation sources for all Cloud Native Architecture indicators

See src/tools/ for the precise schemas implemented with Zod. Each tool returns either a successful object or an error payload containing code, message, and optional hint.

Usage Examples

When using the MCP server with Claude Desktop or other MCP clients, here are some example queries:

Getting KSI Information:

"List all available FedRAMP documents"

→ Uses list_frmr_documents

"Show me all KSI items for moderate impact systems" → Uses filter_by_impact with impact='moderate'

"Give me a summary of the IAM theme requirements" → Uses get_theme_summary with theme='IAM'

"What evidence do I need for IAM compliance?" → Uses get_evidence_examples with theme='IAM'

Searching Documentation:

"Search for information about continuous monitoring"

→ Uses search_markdown with query 'continuous monitoring'

"What does 'federal customer data' mean in FedRAMP?" → Uses search_definitions with term='federal customer data'

"Get the details for requirement KSI-IAM-01" → Uses get_requirement_by_id with id='KSI-IAM-01'

Working with Controls:

"What FedRAMP requirements map to control AY-01?"

→ Uses get_control_requirements with control='AY-01'

"Which control families have the most FedRAMP coverage?" → Uses analyze_control_coverage

"Find all markdown files that reference AC-2" → Uses grep_controls_in_mark