Overview

This MCP (Model Context Protocol) server exposes Secureframe’s compliance automation data to MCP-compatible AI assistants and developer tools. It provides read-only access to controls, tests, personnel, vendors, integrations, and repository scopes across common frameworks such as SOC 2, ISO 27001, CMMC, and FedRAMP. The server is intended to let AI assistants surface contextual audit information and assist engineers, auditors, and security teams when investigating compliance posture or preparing evidence.

The server runs locally and proxies queries to the Secureframe API; it implements the MCP specification so tools like Claude Desktop, Cursor IDE, or other MCP clients can call structured read-only operations. Because it is read-only, it cannot modify your Secureframe data, but you should still validate any AI-generated summaries or remediation suggestions against your official records and compliance policies.

Features

Read-only MCP server exposing Secureframe audit data and compliance metadata
Support for multiple compliance frameworks: SOC 2, ISO 27001, CMMC, FedRAMP, etc.
11 predefined, discoverable MCP tools for controls, tests, users, vendors, repositories, and integrations
Lucene-style search query support for powerful filtering
Local execution for privacy: run behind your network controls with environment-based credentials
Simple integration examples for Claude Desktop and Cursor IDE
Development/debugging support via MCP Inspector

Installation / Configuration

Prerequisites: Python 3.7+ and Secureframe API credentials.

Quick install

git clone https://github.com/secureframe/secureframe-mcp-server.git
cd secureframe-mcp-server

# Optional: create and activate venv
python -m venv venv
source venv/bin/activate   # Windows: venv\Scripts\activate

pip install -r requirements.txt

# Copy example env file and edit
cp env.example .env
# Edit .env to add SECUREFRAME_API_KEY and SECUREFRAME_API_SECRET

Environment variables

SECUREFRAME_API_KEY       # required
SECUREFRAME_API_SECRET    # required
SECUREFRAME_API_URL       # optional (defaults to https://api.secureframe.com)

Regional endpoints

US (default): https://api.secureframe.com
UK: https://api-uk.secureframe.com

Configure Claude Desktop (example)

{
  "mcpServers": {
    "secureframe": {
      "command": "python",
      "args": ["/absolute/path/to/secureframe-mcp-server/main.py"],
      "env": {
        "SECUREFRAME_API_KEY": "your_api_key",
        "SECUREFRAME_API_SECRET": "your_api_secret",
        "SECUREFRAME_API_URL": "https://api.secureframe.com"
      }
    }
  }
}

Configure Cursor IDE (example)

{
  "mcpServers": {
    "Secureframe": {
      "command": "python",
      "args": ["/absolute/path/to/secureframe-mcp-server/main.py"],
      "env": {
        "SECUREFRAME_API_KEY": "your_api_key",
        "SECUREFRAME_API_SECRET": "your_api_secret"
      }
    }
  }
}

Available Tools

The server exposes a set of read-only MCP tools (operations). Common ones include:

Tool name	Purpose
list_controls	Query security controls and their health/status
list_tests	Retrieve compliance tests with pass/fail status
list_users	Enumerate personnel and compliance attributes
list_devices	List managed devices and compliance state
list_user_accounts	User accounts from connected integrations
list_tprm_vendors	Third-party risk management vendors and risk levels
list_vendors	Legacy vendor list
list_frameworks	Available compliance frameworks and metadata
list_repositories	Code repositories and audit scope
list_integration_connections	Integration connection status
list_repository_framework_scopes	Repository scope per framework

Each tool accepts pagination and a search_query parameter supporting Lucene-like syntax for filtering.

Use Cases

Monitor failing controls

# Retrieve controls that are unhealthy for SOC 2
list_controls(search_query="health_status:unhealthy AND frameworks:soc2_alpha", per_page=50)

Find recent failing tests

# Top 5 failing tests across frameworks
list_tests(search_query="health_status:fail", per_page=5)

Review high-risk third parties

# High-risk TPRM vendors that are active
list_tprm_vendors(search_query="risk_level:High AND archived:false", per_page=20)

Spot inactive contractors

# Identify contractors who are marked inactive
list_users(search_query="employee_type:contractor AND active:false", per_page=100)

Search examples (Lucene-style)

Critical failing tests: health_status:fail AND frameworks:soc2_alpha
Inactive users: active:false AND employee_type:contractor
High-risk vendors: risk_level:High AND archived:false

Development & Debugging

Use the Model Context Protocol inspector during development:

npx @modelcontextprotocol/inspector python main.py

This helps validate MCP tool signatures and interactions with MCP clients.

Security & Notes

The server is read-only but runs with API credentials: treat credentials as sensitive and store them securely.
This project has been released in a public beta; validate AI-driven findings against authoritative records before taking compliance or security actions.
Obtain API keys from your Secureframe account under Company Settings → API Keys.

Resources

Secureframe API docs: https://developer.secureframe.com/
Model Context Protocol: https://modelcontextprotocol.io/
Repository: https://github.com/secureframe/secureframe-mcp-server

Secureframe MCP Server for Compliance Audits