Search and query 4,700+ security data points through a single MCP interface — NIST (1,196 SP 800-53 controls with 53A assessments and 53B baselines, CSF 2.0, PF 1.0, SP 800-37 RMF, 613 publications, CMVP, NICE, glossary, CSF↔800-53 mappings) and OWASP (Top 10, API/LLM/MCP Top 10, ASVS 5.0, WSTG, MASVS, Proactive Controls, 815+ CWEs, 559 CAPEC attack patterns, 113+ Cheat Sheets, 418+ projects) — with live NVD/CVE + CISA KEV + EPSS, PDF reading, compliance mapping, STRIDE threat modeling, and MCP security assessment.
Quick Start
pip install git+https://github.com/zer0-kr/security-framework-mcp.git
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"security": {
"command": "security-framework-mcp"
}
}
}
Claude CLI (Claude Code):
claude mcp add security -- security-framework-mcp
{ "security": { "command": "security-framework-mcp" } }
First run automatically builds the local database (~15-20 seconds). Auto-refreshes weekly.
Data Sources (22 local + 3 live)
NIST (10)
OWASP (12)
Live APIs
Tools (41)
NIST
OWASP
Vulnerability & CWE
Analysis & Assessment
Prompts (4)
Use Cases
Vulnerability Management
> Triage CVE-2021-44228 and CVE-2023-44487 — show EPSS, CVSS, KEV status
> Show all CISA KEV entries for Microsoft added after 2025-01-01
> Show only KEV vulnerabilities with known ransomware campaign use
> What attack patterns target CWE-502 (deserialization)?
> Map CWE-79 to OWASP Top 10, ASVS requirements, WSTG tests, and remediation guidance
Compliance & Audit
> What NIST SP 800-53 controls and ASVS requirements map to PCI-DSS 8.3?
> Map ASVS V4 to PCI-DSS 4.0, ISO 27001, and NIST 800-53
> Map NIST SP 800-53 AC family to PCI-DSS and ISO 27001
> Show SP 800-53 LOW baseline controls for the IA (Identification and Authentication) family
> Show SP 800-53 AC-1 control with 53A assessment objectives
Threat Modeling & Architecture Review
> Generate a STRIDE threat model: payment API, JWT auth, PostgreSQL, Redis cache
> Assess my stack: React, Node.js, PostgreSQL, REST API, AWS Lambda
> Find CAPEC attack patterns related to SQL injection
> Search all NIST and OWASP sources for "zero trust"
Development Security
> Generate a comprehensive security checklist for a web API project
> Show OWASP Cheat Sheet for Authentication
> Cross-reference CWE-352 (CSRF) to Top 10, ASVS, and WSTG test cases
> Show ASVS V3 (Session Management) level 2 requirements
> Search NVD for critical log4j CVEs
Configuration
Architecture
┌─────────────────────────────────┐
│ MCP Client │
│ (Claude / Cursor / OpenCode) │
└──────────────┬──────────────────┘
│ stdio
┌──────────────▼──────────────────┐
│ security-framework-mcp │
│ 41 tools · 4 prompts · 6 rsrc │
├──────────────┬──────────────────┤
│ SQLite FTS5 │ Live APIs │
│ (~6.2MB) │ NVD+KEV+EPSS │
├──────────────┴──────────────────┤
│ NIST Collectors (10) │
│ OWASP Collectors (12) │
└──────────────┬──────────────────┘
│ httpx (retry)
┌──────────────▼──────────────────┐
│ NIST OSCAL/CSRC · OWASP GitHub │
└─────────────────────────────────┘
Development
git clone https://github.com/zer0-kr/security-framework-mcp.git
cd security-framework-mcp
pip install -e ".[dev]"
python -m pytest tests/test_unit_db.py tests/test_unit_collectors.py -v
python tests/test_comprehensive.py
Contributing
- Fork → 2. Branch → 3. Test (
python -m pytest) → 4. PR
License
Not affiliated with OWASP Foundation or NIST. Data sourced from public repositories.
