Skip to content
Agentmart
Submit a tool

FedRAMP 20x Requirements

An MCP server that provides access to FedRAMP 20x security requirements and controls.

Connector by KevinRabun · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 6
Write a review

Chalk Labs

Need help deploying FedRAMP 20x Requirements?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/kevinrabun-fedramp20xmcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

An MCP server that provides access to FedRAMP 20x security requirements and controls.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
42 read · 1 write · 0 delete · 5 not yet classified
Secrets
None asked for
Install scripts
Not scanned yet
Runs as
Python package

Tools by what they do 48

Read from the source code; the running server may list different tools.

Read 42 · Look things up without changing anything.

  • analyze_all_frrs
  • analyze_application_code
  • analyze_cicd_pipeline
  • analyze_frr_code
  • analyze_frr_family
  • analyze_infrastructure_code
  • check_package_vulnerabilities
  • check_requirement_dependencies
  • compare_with_rev4
  • estimate_implementation_effort
  • get_cloud_native_guidance
  • get_control
Show 30 more tools
  • get_definition
  • get_documentation_file
  • get_evidence_automation_architecture
  • get_evidence_collection_code
  • get_frr_evidence_automation
  • get_frr_implementation_status
  • get_frr_metadata
  • get_implementation_examples
  • get_infrastructure_code_for_ksi
  • get_ksi
  • get_ksi_coverage_status
  • get_ksi_coverage_summary
  • get_ksi_evidence_artifacts
  • get_ksi_evidence_automation
  • get_ksi_evidence_queries
  • get_ksi_family_status
  • get_ksi_implementation_matrix
  • get_ksi_implementation_status
  • get_ksi_implementation_summary
  • list_definitions
  • list_documentation_files
  • list_family_controls
  • list_frrs_by_family
  • list_ksi
  • scan_dependency_file
  • search_definitions
  • search_documentation
  • search_requirements
  • validate_architecture
  • validate_fedramp_config

Write 1 · Create, change, send or run things.

  • add_requirement_comments

Not yet classified 5 · We could not tell from the name and description.

  • export_to_csv
  • export_to_excel
  • generate_implementation_checklist
  • generate_implementation_questions
  • generate_ksi_specification

Files it touches

  • Any path the agent passes to its tools

Tools (48)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • add_requirement_comments

    Add FedRAMP requirement comments to code or IaC templates. Enriches generated code with detailed KSI and FRR requirement information in comments, ensuring traceability to specific compliance requirements. Args: code: The code or template to enrich ksi_ids: Comma-separated KSI IDs (e.g., "KSI-IAM-01,KSI-MLA-01") frr_ids: Comma-separated FRR IDs (e.g., "FRR-VDR-01,FRR-ADS-01") language: Programming language for comment syntax Options: bicep, terraform, python, csharp, java, typescript, powershell Returns: Enriched code with requirement header comments and inline an…

  • analyze_all_frrs

    Analyze code against all FedRAMP requirements. Performs comprehensive analysis across all 199 FRR requirements. Args: code: Code to analyze language: Language/platform file_path: Optional file path for context Returns: Complete analysis results grouped by family

  • analyze_application_code

    Analyze application code for FedRAMP 20x security compliance issues. Args: code: The application code content to analyze language: Programming language ("python", "csharp", "java", "typescript", "javascript") file_path: Optional path to the file being analyzed dependencies: Optional list of dependencies/imports to check application_profile: Optional application profile to reduce false positives. Supported profiles: "cli-tool", "mcp-server", "web-app", "api-service", "iac-only", "library", "batch-job", "full" (default). Example: Use "cli-tool" for a …

  • analyze_cicd_pipeline

    Analyze CI/CD pipeline configuration for FedRAMP 20x DevSecOps compliance. Args: code: The pipeline configuration content (YAML/JSON) pipeline_type: Type of pipeline ("github-actions", "azure-pipelines", "gitlab-ci", or "generic") file_path: Optional path to the pipeline file application_profile: Optional application profile to reduce false positives. Supported profiles: "cli-tool", "mcp-server", "web-app", "api-service", "iac-only", "library", "batch-job", "full" (default).

  • analyze_frr_code

    Analyze code against a specific FedRAMP requirement (FRR). Detects compliance issues in application code, infrastructure as code, or CI/CD pipelines for the specified FRR. Args: frr_id: FRR identifier (e.g., "FRR-VDR-01", "FRR-RSC-01") code: Code to analyze language: Language/platform (python, csharp, java, typescript, bicep, terraform, github-actions, azure-pipelines, gitlab-ci) file_path: Optional file path for context Returns: Analysis results with findings and recommendations

  • analyze_frr_family

    Analyze code against all requirements in a specific FRR family. Args: family: Family code (VDR, RSC, UCM, SCN, ADS, CCM, MAS, ICP, FSI, PVA, KSI) code: Code to analyze language: Language/platform file_path: Optional file path for context Returns: Analysis results for the specified family

  • analyze_infrastructure_code

    Analyze Infrastructure as Code (Bicep/Terraform) for FedRAMP 20x compliance issues. Args: code: The IaC code content to analyze file_type: Type of IaC file ("bicep" or "terraform") file_path: Optional path to the file being analyzed context: Optional context about the changes (e.g., PR description) application_profile: Optional application profile to reduce false positives. Supported profiles: "cli-tool", "mcp-server", "web-app", "api-service", "iac-only", "library", "batch-job", "full" (default). Example: Use "cli-tool" for a local CLI tool that re…

  • check_package_vulnerabilities

    Check a package for known CVE vulnerabilities against authoritative databases. Queries GitHub Advisory Database (and optionally NVD) for security vulnerabilities in the specified package. Returns detailed CVE information, affected versions, patched versions, severity ratings, and FedRAMP compliance recommendations. Args: package_name: Package name (e.g., "Newtonsoft.Json", "lodash", "requests", "log4j") ecosystem: Package ecosystem - "nuget" (.NET), "npm" (JavaScript/TypeScript), "pypi" (Python), "maven" (Java) version: Specific version to check (optional, checks all versions if …

  • check_requirement_dependencies

    Show which requirements are related or dependent on a specific requirement.

  • compare_with_rev4

    Compare FedRAMP 20x requirements to Rev 4/Rev 5 to understand changes.

  • estimate_implementation_effort

    Provide rough effort estimates for implementing a specific requirement.

  • export_to_csv

    Export FedRAMP 20x data to CSV format.

  • export_to_excel

    Export FedRAMP 20x data to Excel format.

  • generate_implementation_checklist

    Generate actionable step-by-step implementation checklist for a specific KSI.

  • generate_implementation_questions

    Generate strategic questions for PMs and engineers about implementing a requirement.

Show 33 more tools
  • generate_ksi_specification

    Generate a detailed product specification document for a KSI.

  • get_cloud_native_guidance

    Get cloud-native specific guidance for implementing FedRAMP 20x.

  • get_control

    Get detailed information about a specific FedRAMP 20x requirement.

  • get_definition

    Get the FedRAMP definition for a specific term.

  • get_documentation_file

    Get the full content of a specific FedRAMP documentation file.

  • get_evidence_automation_architecture

    Provide comprehensive architecture guidance for automated evidence collection.

  • get_evidence_collection_code

    Provide code examples for collecting KSI evidence programmatically.

  • get_frr_evidence_automation

    Get evidence automation recommendations for a specific FRR. Provides detailed guidance on automating evidence collection including: - Azure services needed - Collection methods and queries (KQL, REST API) - Storage requirements - Evidence artifacts to collect Args: frr_id: FRR identifier (e.g., "FRR-VDR-01") Returns: Evidence automation recommendations

  • get_frr_implementation_status

    Get implementation status summary across all FRR analyzers. Shows statistics by family with implementation rates. Returns: Status summary with family breakdown

  • get_frr_metadata

    Get detailed metadata for a specific FRR. Returns NIST controls, related KSIs, impact levels, and detection strategy. Args: frr_id: FRR identifier (e.g., "FRR-VDR-01") Returns: Detailed FRR metadata

  • get_implementation_examples

    Get practical implementation examples for a requirement.

  • get_infrastructure_code_for_ksi

    Generate infrastructure code templates for automating KSI evidence collection.

  • get_ksi

    Get detailed information about a specific Key Security Indicator.

  • get_ksi_coverage_status

    Check if a specific KSI has analyzer coverage and what the limitations are. Args: ksi_id: The KSI identifier (e.g., "KSI-MLA-05") Returns detailed coverage information including which analyzers support this KSI, whether it's process-based or technical, and important limitations of the coverage.

  • get_ksi_coverage_summary

    Get a summary of KSI analyzer coverage and recommendation quality assessment. Shows which KSIs have analyzer coverage, what limitations exist, and important disclaimers about recommendation validation. Use this to understand the scope and limitations of automated compliance checking.

  • get_ksi_evidence_artifacts

    Get list of evidence artifacts to collect for a specific KSI. Returns detailed information about what artifacts to collect: - Artifact names and types (logs, configs, reports) - Collection methods and frequency - File formats and retention requirements Args: ksi_id: The KSI identifier (e.g., "KSI-IAM-01", "KSI-CNA-01") Returns: Evidence artifacts list with collection details

  • get_ksi_evidence_automation

    Get evidence automation recommendations for a specific KSI. Provides detailed guidance on automating evidence collection including: - Azure services needed - Collection methods and schedules - Storage requirements and retention - FRR-ADS API integration - Code examples and infrastructure templates - Implementation effort and prerequisites Args: ksi_id: The KSI identifier (e.g., "KSI-IAM-01", "KSI-CNA-01") Returns: Comprehensive evidence automation recommendations

  • get_ksi_evidence_queries

    Get evidence collection queries for a specific KSI. Returns ready-to-use queries for collecting evidence from Azure: - KQL queries for Log Analytics - Azure Resource Graph queries - REST API calls for Microsoft Graph Args: ksi_id: The KSI identifier (e.g., "KSI-IAM-01", "KSI-CNA-01") Returns: Collection queries with descriptions and usage guidance

  • get_ksi_family_status

    Get implementation status for a specific KSI family. Args: family: Family code (e.g., "IAM", "SVC", "CNA", "AFR", "MLA") Returns: JSON with family-specific status: - Total KSIs in family - Active vs retired count - Implementation status - Code detectability breakdown - List of all KSIs with their properties Supported families: - IAM: Identity and Access Management - SVC: Service Configuration - MLA: Monitoring, Logging, and Alerting - CNA: Cloud and Network Architecture - AFR: Authorization by FedRAMP - TPR: Third-Party Risk - CMT: Change Management and Testing -…

  • get_ksi_implementation_matrix

    Get implementation matrix showing all KSIs in a family with Azure services, effort, and priority.

  • get_ksi_implementation_status

    Get comprehensive implementation status of all KSI analyzers. Dynamically queries each KSI analyzer to report: - Total KSIs, active vs retired - Implementation status (IMPLEMENTED, PARTIAL, NOT_IMPLEMENTED) - Code detectability (CODE_DETECTABLE vs PROCESS_BASED) - Status organized by family - Implementation percentages Returns: JSON with complete KSI status including: - Overall statistics (total, active, implemented, code_detectable) - Family-level breakdown - Individual KSI details with metadata - Implementation and code detectability percentages This tool eliminates th…

  • get_ksi_implementation_summary

    Get a summary of KSI implementation status across all families. Returns statistics showing: - Overall implementation coverage - Breakdown by family - Code-detectable vs process-based KSIs - Retired KSIs

  • list_definitions

    List all FedRAMP definitions with their terms.

  • list_documentation_files

    List all available FedRAMP documentation files.

  • list_family_controls

    List all requirements within a specific document family.

  • list_frrs_by_family

    List all FRR requirements in a specific family. Shows implementation status and code detectability for each FRR. Args: family: Family code (VDR, RSC, UCM, SCN, ADS, CCM, MAS, ICP, FSI, PVA, KSI) Returns: List of FRRs with status indicators

  • list_ksi

    List all Key Security Indicators with their implementation status. Returns a comprehensive list showing: - Implementation status (Implemented/Not Implemented/Retired) - Code detectability (Code-Detectable vs Process-Based) - Organized by family - Summary statistics

  • scan_dependency_file

    Scan an entire dependency file for vulnerable packages. Analyzes dependency manifests and checks all packages against CVE databases. Provides comprehensive vulnerability report with prioritized remediation guidance. Args: file_content: Full content of the dependency file file_type: Type of file - "csproj", "packages.config", "package.json", "requirements.txt", "pom.xml" github_token: GitHub Personal Access Token for higher API rate limits (optional) Returns: JSON with scan results including total vulnerabilities, severity breakdown, vulnerable packages list, and prioriti…

  • search_definitions

    Search FedRAMP definitions by keywords.

  • search_documentation

    Search FedRAMP official documentation by keywords.

  • search_requirements

    Search for FedRAMP 20x requirements containing specific keywords.

  • validate_architecture

    Validate a cloud architecture against FedRAMP 20x requirements.

  • validate_fedramp_config

    Validate Infrastructure as Code against FedRAMP 20x MANDATORY requirements BEFORE generating/deploying. 🚨 USE THIS TOOL BEFORE FINALIZING ANY TEMPLATE/CODE 🚨 This tool checks for CRITICAL violations that will cause compliance failures: - Log Analytics retention < 730 days (CRITICAL) - Platform-managed keys instead of Customer-Managed Keys (CRITICAL) - Key Vault Standard SKU instead of Premium (CRITICAL) - Public access enabled instead of disabled (CRITICAL) - Missing diagnostic settings (HIGH) Returns: - passed: bool - Whether ALL validations passed - violations: list - CRITICAL issues th…

Signals

Stars
6
Forks
1
Open issues
1
Weekly downloads
89
Last commit
Feb 13, 2026 (8 months ago)
Last release
Feb 13, 2026 (8 months ago)
Last package publish
Feb 13, 2026 (8 months ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.KevinRabun/FedRAMP20xMCP
Version
1.3.0
Auth
No auth
Packages
pypi fedramp-20x-mcp
License
MIT
Repository
github.com/KevinRabun/FedRAMP20xMCP
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registrygithub-graphql

More from KevinRabun

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped
50+
launches shipped
media placements
500+
media placements
founders on every account
2
founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get FedRAMP 20x Requirements running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Goes to the Chalk Labs founders, not the newsletter. Privacy

Need help deploying FedRAMP 20x Requirements?

CallGet help
Cite this page

FedRAMP 20x Requirements MCP server. Agent Mart. https://agentmart.dev/connectors/kevinrabun-fedramp20xmcp (last updated 2026-10-24)