Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y [email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add mcp-server-scf -- npx -y mcp-server-scf@4.1.0รันในเทอร์มินัล
{ "mcpServers": { "mcp-server-scf": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดSecurity compliance controls, frameworks, and risk management for AI agents.
Give your AI assistant access to 1,451 SCF security controls, 354+ framework mappings (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR), evidence tracking, risk registers, and vendor risk management — all through the Model Context Protocol.
Built for the SCF Controls Platform. Maintained by ComplianceGenie.io.
🆕 The platform is now open-source, self-hosted software. The SCF Controls Platform — SCF-native GRC tooling for the free Secure Controls Framework content — is published under AGPL-3.0 at scf-controls-platform-oss. Companies download and host it themselves via Docker Compose.
Having trouble? → docs/troubleshooting.md · API key setup → docs/authentication.md · How it works → docs/architecture.md
mcp-server-scf connects AI assistants to the SCF Controls Platform via MCP, enabling natural language interaction with your compliance program. Your AI can browse the full SCF control catalog, track implementation progress, manage evidence collection, assess risks, and monitor third-party vendors — all without leaving your editor or chat.
224 tools across 15 domains — click through for full parameter tables and example prompts:
Which platform operations became tools, which are deferred, and which stay out on purpose is recorded in docs/tool-scope.md.
Kick the tires without adding the server to a client — MCP Inspector launches a local UI that introspects every tool, its schema, and its description:
npx @modelcontextprotocol/inspector npx -y mcp-server-scf
Inspector opens on http://localhost:6274 and connects to mcp-server-scf over stdio. You'll see all 224 tools, grouped by domain, with their Zod schemas rendered as a live form.
Live tool calls need your instance's URL and an API key — export SCF_API_URL and SCF_API_KEY in the same shell before launching Inspector, or set them under the "Environment Variables" tab inside the Inspector UI. Without them, you can still browse schemas and descriptions; tool calls return a configuration error.
The SCF Controls Platform is open-source software you host yourself — there is no sign-up. Deploy it from scf-controls-platform-oss (a Docker Compose stack with bundled PostgreSQL, Redis, and MinIO), then:
API_KEY in the platform's .env (generate one with openssl rand -hex 32), or create a key in Settings → API Keys once the app is running.http://localhost:8000 by default, or your deployed host.Use that key as SCF_API_KEY and the instance URL as SCF_API_URL (see Configuration).
Pick the route for your client.
Claude Desktop — the one-click path is the signed .mcpb Desktop Extension below. Claude Desktop does not register a custom URL scheme, so there is no clickable deeplink; instead you drag the .mcpb onto Settings → Extensions and paste your API key once. See anthropics/claude-code#26952 for the upstream tracking issue.
Cursor — click the badge below. Cursor registers the cursor:// scheme, so the deeplink opens the IDE with the server config pre-filled:
After install, edit the pre-filled SCF_API_URL to point at your instance — there is no hosted default.
Prefer to edit config by hand, or on a client without a deeplink (Windsurf, Docker)? See 3. Manual config below.
For Claude Desktop ≥ 0.11.0, the easiest install is a signed .mcpb bundle — no JSON editing, no npx runtime, no Node required on the host:
mcp-server-scf-<version>.mcpb from the latest GitHub release.scf_… API key. It's stored in your OS keychain, not in a config file.To uninstall or update the API key later: Settings → Extensions → SCF Controls Platform → Configure.
Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"scf": {
"command": "npx",
"args": ["-y", "mcp-server-scf"],
"env": {
"SCF_API_KEY": "your_api_key_here",
"SCF_API_URL": "http://localhost:8000"
}
}
}
}
Claude Code:
claude mcp add scf -- npx -y mcp-server-scf
export SCF_API_KEY="your_api_key_here"
export SCF_API_URL="http://localhost:8000"
Cursor / Windsurf — same JSON shape as Claude Desktop in .cursor/mcp.json (or the equivalent Windsurf path).
Docker:
{
"mcpServers": {
"scf": {
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "SCF_API_KEY", "-e", "SCF_API_URL", "markac007/mcp-server-scf"],
"env": {
"SCF_API_KEY": "scf_your_api_key_here",
"SCF_API_URL": "https://scf.your-domain.example"
}
}
}
}
Once connected, try asking your AI assistant:
More examples live in each per-domain doc under docs/tools/.
See SECURITY.md to report a vulnerability.
mcp-server-scf is a stateless connector — it stores no user data itself. All data flows directly between your MCP client and your own SCF Controls Platform instance, authenticated with your API key; nothing is sent to, or retained by, any third party. See the full privacy policy for details.
git clone https://github.com/MarkAC007/mcp-server-scf.git
cd mcp-server-scf
npm install
npm run build
npm run dev # Watch mode
npm run lint # ESLint
npm test # Vitest
SCF_API_KEY=scf_your_key npx @modelcontextprotocol/inspector node build/index.js
Contributions welcome! Please read CONTRIBUTING.md before submitting PRs.
This project follows the Contributor Covenant — see CODE_OF_CONDUCT.md. By participating, you are expected to uphold this code.
git checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)MIT — see LICENSE.
MCP server for the SCF Controls Platform — security compliance controls, frameworks, evidence, and risk management for AI agents
{ "mcpServers": { "mcp-server-scf": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
MCP Server Scf ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-11-14 MCP server for the SCF Controls Platform — security compliance controls, frameworks, evidence, and risk management for AI agents