Server Scf MCP Server
Security compliance controls, frameworks, and risk management for AI agents. Give your AI assistant access to 1,451 SCF security controls, 354+ framework mappings (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR), evidence tracking, risk registers, and vendor risk management - all through the Model Context Protocol. It runs locally over stdio via the published package.
People who work with compliance, fedramp and grc and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.
VERIFIED ACTIVE
LAST COMMIT 2026-09-16 · ★ 2 · #22 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18
MIT · TypeScript servers · how we verify → /methodology
01 · Install Server Scf
before you install - you'll need
Set SCF_API_KEY before connecting. SCF_API_URL is optional or environment-specific per the README.
Claude Code
claude mcp add markac007-mcp-server-scf -- npx -y mcp-server-scfClaude Desktop / Cursor / VS Code - add to config
{
"mcpServers": {
"markac007-mcp-server-scf": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf"
]
}
}
}Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.
Using another client? Same JSON, different key
Claude Desktop · mcpServers
Cursor · mcpServers
VS Code · servers
Windsurf · mcpServers
Zed · context_servers
Cline · mcpServers
Roo Code · mcpServers
Continue · mcpServers
LibreChat · mcpServers
Gemini CLI · mcpServers
Codex CLI · mcp_servers
Full setup guides: every client.
02 · Evidence
Security posture
What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.
runs as local process (stdio) - runs on your machine with your user's permissions
license MIT - declared in the repository
npm package mcp-server-scf - unscoped; check the name against the project README before installing
registry vendor namespace app.scfcontrolsplatform - domain-verified with the official MCP registry
03 · What Server Scf can do
Prose above is summarized from the project's README and registry record - no invented capabilities.
Latest releases
v3.5.0 · 2026-09-18
PR #237: feat: window verdict review tools, review-queue tier, full system-type vocabulary (#235, #236) · window verdict review tools, review-queue tier, full system-type vocabulary · act on code review of #237…
v3.4.2 · 2026-09-14
PR #222: ci(codeql): bump init/autobuild/analyze together to v4.36.3 and group future codeql-action bumps · Other Changes · pin init/autobuild/analyze to v4.36.3 · --- · Merged by: @MarkAC007 · mcp-server-scf@3.4.2…
v3.4.1 · 2026-09-14
PR #221: fix(deps): clear five open Dependabot advisories (hono 4.13.7, vitest 4.1.11) · clear five open Dependabot advisories (hono, vitest) · --- · Merged by: @MarkAC007 · mcp-server-scf@3.4.1 · Claude Desktop…
04 · Who maintains Server Scf
mcp-server-scf is maintained by markac007. It's the only MCP server we track from this author; the repo dates to Feb 2026.
05 · Facts
- repository
- github.com/markac007/mcp-server-scf
- website
- https://scfcontrolsplatform.com/
- category
- security - ranked #22 of 204 actively-maintained security servers as of 2026-09-18.
- release cadence
- 10+ releases in the last 90 days (latest 2026-09-18)
- registry
- app.scfcontrolsplatform/mcp-server-scf (active, first published 2026-04-18 · 45 versions)
- packages
- npm:mcp-server-scf
06 · Server Scf FAQ
What is Server Scf?
Security compliance controls, frameworks, and risk management for AI agents. Give your AI assistant access to 1,451 SCF security controls, 354+ framework mappings (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR), evidence tracking, risk registers, and vendor risk management - all through the Model Context Protocol. It runs locally over stdio via the published package.
Is Server Scf still maintained?
Yes - as of 2026-09-18, its last commit was 2026-09-16 and it shipped 10+ releases in the last 90 days. We re-verify nightly.
How do I install Server Scf?
Run `npx -y mcp-server-scf`. The README documents 2 environment variables (SCF_API_KEY, SCF_API_URL) to set first. Set SCF_API_KEY before connecting. SCF_API_URL is optional or environment-specific per the README. You can also paste the ready-made client config above.
Does Server Scf run locally?
Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.
07 · Alternatives to Server Scf
Alternatives to Server Scf
Maintained security servers if Server Scf isn't the fit.
- Treg To OpenRouter for tools and data. Compare catalog providers and call them from one hosted MCP endpoint. ★ 1,627 · 2026-09-18
- SafeDep Vet MCP Protect your AI agents and IDEs from malicious open-source packages. ★ 1,105 · 2026-09-16
- SonarQube MCP Server Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants. ★ 652 · 2026-09-17
- HOL Guard Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server. ★ 625 · 2026-09-18
- Decionis CommerceGate MCP Commerce preflights, D365 authorization, signed evidence, and reports; no marketplace or ERP writes. ★ 533 · 2026-09-18
- Emisar Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step. ★ 353 · 2026-09-15
Pairs well with
Servers that cover what Server Scf doesn't - only shown when the pairing reason fits the companion.
More security MCP servers · Mastyf AI · MCPAmpel - MCP Security Scanner · Customs · Zendesk MCP · Ephemora Cell MCP - WASM Sandbox
More TypeScript MCP servers · Delta · Doordash · Instacart · Southwest · Ubereats · see all