NIST MCP Server

A professional Model Context Protocol (MCP) server providing comprehensive access to NIST cybersecurity frameworks and controls. Enables AI assistants and applications to query, analyze, and manage NIST security controls through a standardized, secure interface.

🚀 Quick Start

Get started with NIST’s complete control catalog in minutes:

# Install and run
git clone https://github.com/your-username/nist-mcp.git
cd nist-mcp
./scripts/install.sh
python -m nist_mcp.server

That’s it! Your MCP server is now running with access to 1,196+ NIST security controls.

🔧 What You Can Do

Core Control Operations

• Browse all NIST SP 800-53 controls (1,196 total: base controls + enhancements)
• Get detailed control information with implementation guidance
• Search by keywords, families, or baseline levels
• Map controls to Cybersecurity Framework subcategories

Enterprise Compliance Support

• CMMC 2.0 assessments across all 5 maturity levels
• FedRAMP readiness for Low/Moderate/High impact systems
• SP 800-171 CUI baseline for protecting sensitive information
• NIST Cybersecurity Framework alignment and mapping

Advanced Analysis

• Gap analysis against baseline requirements
• Coverage assessments across control families
• Compliance mapping to other frameworks (SOC2, ISO27001)
• Risk evaluation of control implementations

📖 Installation & Setup

One-Command Setup (Recommended)

git clone https://github.com/your-username/nist-mcp.git
cd nist-mcp
./scripts/install.sh
python -m nist_mcp.server

That’s it! Your NIST MCP server is now running with 1,196+ controls.

Manual Setup

# 1. Clone and install
git clone https://github.com/your-username/nist-mcp.git
cd nist-mcp
pip install -e ".[dev]"

# 2. Download NIST data
python scripts/download_nist_data.py

# 3. Start server
python -m nist_mcp.server

Prerequisites

• Python 3.10+
• uv package manager (optional, but recommended)

🛠️ Practical Examples

Here are real examples of how to use the NIST MCP tools:

Basic Control Lookup

“What does AC-1 say?”

// Call: get_control("AC-1")
{
  "id": "ac-1",
  "title": "Policy and Procedures",
  "class": "SP800-53",
  "family": "AC",
  "parts": [
    {
      "name": "statement",
      "prose": "The organization develops and maintains a comprehensive security policy..."
    }
  ],
  "links": [...]
}

“Show me all Access Control family controls”

// Call: get_control_family("AC")
{
  "family": "AC",
  "name": "Access Control",
  "description": "The AC family contains controls...",
  "total_controls": 57,
  "base_controls": 25,
  "enhancements": 32,
  "controls": [...]
}

Compliance Analysis

“Do we meet Moderate baseline requirements?”

// Call: gap_analysis(implemented_controls=["AC-1", "AU-1"], target_baseline="moderate")
{
  "total_required": 177,