# app.scfcontrolsplatform/mcp-server-scf (npm · mcp-server-scf)

MCP server for the SCF Controls Platform — 83 tools for controls, evidence, risk, and TPRM.

- Trust score: 80/100 (high trust)
- Change this week: +56
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `mcp-server-scf`: 80/100 (this document), [markdown](https://verifymcp.io/servers/app-scfcontrolsplatform-mcp-server-scf/mcp-server-scf.md), [page](https://verifymcp.io/servers/app-scfcontrolsplatform-mcp-server-scf/mcp-server-scf)

## Channel facts

- Registry: `npm`
- Package: `mcp-server-scf`
- Version: `2.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to MarkAC007/mcp-server-scf).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 16 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 80/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 9120 tokens (~103/item across 88 items; 88 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add app-scfcontrolsplatform-mcp-server-scf -- npx -y mcp-server-scf
```

### Codex

```bash
codex mcp add app-scfcontrolsplatform-mcp-server-scf -- npx -y mcp-server-scf
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-scfcontrolsplatform-mcp-server-scf": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-server-scf"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-scfcontrolsplatform-mcp-server-scf --command npx --arg -y --arg mcp-server-scf
```

### Hermes

```yaml
mcp_servers:
  app-scfcontrolsplatform-mcp-server-scf:
    command: "npx"
    args: ["-y", "mcp-server-scf"]
```

### Other

```json
{
  "mcpServers": {
    "app-scfcontrolsplatform-mcp-server-scf": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-server-scf"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 80, +75)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: MarkAC007/mcp-server-scf
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional] Licence: MIT

### 2026-08-01 (score 5, −16)

- [functional regression] Tool coverage: 100 → unverified

### 2026-07-31 (score 21, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 46, +22)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: unverified
- [functional] First check of Tool coverage: 100

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (88)

### `scf_list_controls` (~167 tokens)

List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search.

Input parameters:

- `domain` (string): SCF domain code (e.g., 'GOV', 'AST', 'IAC') — obtain from scf_list_domains
- `framework` (string): Framework slug (e.g., 'nist-800-53', 'iso-27001') — obtain from scf_list_frameworks
- `limit` (integer): Page size (1–100, default 25)
- `offset` (integer): Pagination offset — number of results to skip (default 0)
- `search` (string): Free-text filter applied to control title and description

### `scf_get_control` (~75 tokens)

Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog.

Input parameters:

- `scf_id` (string, required): SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'IAC-15', 'GOV-02')

### `scf_list_frameworks` (~57 tokens)

List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names.

### `scf_list_domains` (~45 tokens)

List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control).

### `scf_list_evidence_catalog` (~96 tokens)

List evidence items from the SCF reference catalog — the 272 standard evidence types that can be collected to demonstrate control implementation. Supports free-text search and pagination.

Input parameters:

- `limit` (integer): Page size (1–100, default 25)
- `offset` (integer): Pagination offset — number of results to skip (default 0)
- `search` (string): Free-text filter applied to evidence title and description

### `scf_list_assessment_objectives` (~129 tokens)

List SCF assessment objectives — the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination.

Input parameters:

- `control_id` (string): Limit to one SCF control in DOMAIN-NN format (e.g., 'GOV-01', 'AST-02')
- `limit` (integer): Page size (1–100, default 25)
- `offset` (integer): Pagination offset — number of results to skip (default 0)
- `search` (string): Free-text filter applied to objective text

### `scf_list_scoped_controls` (~262 tokens)

List controls scoped to the organization with implementation status. Filter by scope status, domain, framework, CSF function, weighting, or free-text search. Paginated.

Input parameters:

- `control_weighting` (integer): Weighting threshold on a 0–10 scale
- `csf_function` (string): NIST CSF function: 'GOVERN', 'IDENTIFY', 'PROTECT', 'DETECT', 'RESPOND', or 'RECOVER'
- `domain` (string): SCF domain code (e.g., 'GOV', 'AST', 'IAC')
- `framework` (string): Framework slug (e.g., 'nist-800-53') to filter mapped controls
- `limit` (integer): Page size (1–200, default 50)
- `offset` (integer): Pagination offset — number of results to skip (default 0)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `scope_status` (string): Scope filter: 'in_scope' (selected), 'out_of_scope' (deselected), or 'all' (default — everything)
- `search` (string): Free-text filter applied to control ID, name, or description

### `scf_get_scoped_control` (~96 tokens)

Get one scoped control in detail: owner, implementation notes, evidence links, and audit history. Identify by scf_id, not by UUID.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `scf_id` (string, required): SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') — NOT the UUID

### `scf_update_scoped_control` (~303 tokens)

Update a scoped control's implementation fields (write — editor+ role). Identify by scf_id, not UUID. Only provided fields are applied.

Input parameters:

- `assigned_to` (string): Assignee responsible for implementation
- `completion_date` (string): Actual completion date in ISO-8601 (YYYY-MM-DD)
- `implementation_notes` (string): Free-text implementation notes and context
- `implementation_status` (string): New implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, or deferred
- `maturity_level` (string): Maturity level with L prefix: L0 Not Performed, L1 Performed, L2 Planned, L3 Well Defined, L4 Quantitatively Controlled, L5 Continuously Improving
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `owner` (string): Accountable owner of the control
- `priority` (string): Implementation priority: 'high', 'medium', or 'low'
- `scf_id` (string, required): SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') — NOT the UUID
- `selection_reason` (string): Justification for scoping decision — required for not_applicable or deferred
- `target_date` (string): Target completion date in ISO-8601 (YYYY-MM-DD)

### `scf_get_scoping_stats` (~50 tokens)

Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_scope_framework` (~92 tokens)

Bulk-scope every control mapped to a framework into the organization (write — editor+ role). Creates a scoped-control entry for each control in the framework.

Input parameters:

- `framework_id` (string, required): Framework slug to scope (e.g., 'nist-800-53-r5') — obtain from scf_list_frameworks
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_batch_update_controls` (~79 tokens)

Batch-update up to 500 scoped controls in one transaction (write — editor+ role). Each operation identifies its target by scf_id; status values are lowercase.

Input parameters:

- `operations` (array, required): Update operations to apply (1–500 per call)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_evidence` (~78 tokens)

List evidence items tracked against an organization's controls. Returns each item's tracking status, maturity level, and linked controls. Optionally filter by system.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `system_id` (string): System UUID to filter by — obtain from scf_list_systems

### `scf_create_evidence` (~247 tokens)

Create an evidence tracking record from a catalog evidence ID (write — editor+ role). Starts tracking an evidence item for the organization.

Input parameters:

- `collecting_system` (string): Name of the tool or system that collects the evidence
- `comments` (string): Free-text notes or context
- `evidence_id` (string, required): Catalog evidence ID (e.g., 'E-IAM-01') — obtain from scf_list_evidence_catalog
- `frequency` (string): Collection cadence: 'daily', 'weekly', 'monthly', 'quarterly', or 'annually'
- `is_tracked` (boolean): Start actively tracking this item (default false)
- `maturity_level` (string): Evidence maturity level L0–L5 (e.g., 'L3'); omit to leave unset
- `method_of_collection` (string): Collection approach: 'automated', 'manual', or 'hybrid'
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `owner` (string): Person accountable for this evidence item
- `system_id` (string): System UUID to link this evidence to — obtain from scf_list_systems

### `scf_get_evidence_maturity` (~54 tokens)

Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_item_maturity` (~92 tokens)

Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'E-RSK-02') — obtain from scf_list_evidence
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_upgrade_recommendations` (~96 tokens)

Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions — the same guidance shown in the platform UI.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'E-RSK-02') — obtain from scf_list_evidence
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_suggestions` (~93 tokens)

Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'E-RSK-02') — obtain from scf_list_evidence
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_evidence_gaps` (~56 tokens)

List the organization's evidence coverage gaps: evidence required by in-scope controls that is not yet tracked, with overall coverage percentage.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_health` (~58 tokens)

Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_evidence_files` (~96 tokens)

List all files uploaded or ingested for an evidence item. Returns filename, content type, upload timestamp, validation status, and a pre-signed download URL (15-min expiry).

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_file` (~110 tokens)

Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence
- `file_id` (string, required): Evidence file UUID — obtain from scf_list_evidence_files
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_update_evidence` (~261 tokens)

Upsert an evidence item's tracking fields (write — editor+ role). Creates the tracking row if missing. All body fields are optional; only provided fields are applied.

Input parameters:

- `collecting_system` (string): Name of the tool or system that collects the evidence
- `comments` (string): Free-text notes or context
- `evidence_id` (string, required): Catalog evidence ID (e.g., 'E-IAM-01') — obtain from scf_list_evidence or scf_list_evidence_catalog
- `frequency` (string): Collection cadence: 'daily', 'weekly', 'monthly', 'quarterly', or 'annually'
- `is_tracked` (boolean): Toggle active tracking for this item
- `maturity_level` (string): Evidence maturity level L0–L5 (e.g., 'L3'); omitting never clears the stored value
- `method_of_collection` (string): Collection approach: 'automated', 'manual', or 'hybrid'
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `owner` (string): Person accountable for this evidence item
- `system_id` (string): System UUID to link this evidence to — obtain from scf_list_systems

### `scf_get_evidence_validation` (~112 tokens)

Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence
- `file_id` (string, required): Evidence file UUID — obtain from scf_list_evidence_files
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_revalidate_evidence_file` (~116 tokens)

Re-run the validation engine against an evidence file (write — editor+ role). Checks catalog existence, content type, field coverage, freshness, storage. Returns the updated result.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence
- `file_id` (string, required): Evidence file UUID — obtain from scf_list_evidence_files
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_validation_summary` (~62 tokens)

Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_trigger_evidence_assessment` (~140 tokens)

Queue an AI assessment of a single evidence file (write — editor+ role, async). Returns a pending record; poll scf_get_evidence_assessment until status is sufficient/partial/insufficient.

Input parameters:

- `assessment_source` (string): Origin tag for the request (default on_demand)
- `evidence_id` (string, required): Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence
- `file_id` (string, required): Evidence file UUID — obtain from scf_list_evidence_files
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_assessment` (~124 tokens)

Get the AI assessment for an evidence file: status, relevance score (0–100), structured findings, summary, and audit metadata (model, tokens, cost). Poll after scf_trigger_evidence_assessment.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence
- `file_id` (string, required): Evidence file UUID — obtain from scf_list_evidence_files
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_bulk_assess_evidence` (~124 tokens)

Queue AI assessments for multiple evidence files (write — editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued.

Input parameters:

- `assess_unassessed` (boolean): Also assess every file that has no existing assessment (default false)
- `evidence_id` (string): Evidence ID — assesses every file under this evidence item
- `file_ids` (array): Specific evidence file UUIDs to assess
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_evidence_assessment_summary` (~64 tokens)

Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_evidence_tasks` (~98 tokens)

List evidence collection tasks — the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.

Input parameters:

- `assignee` (string): Filter by assigned user ID
- `org_id` (string): Organization UUID — obtain from scf_list_organizations
- `status` (string): Filter by task status (e.g., 'open', 'in_progress', 'done')

### `scf_trigger_window_assessment` (~123 tokens)

Queue a windowed AI assessment that scores every file in the evidence item's frequency window as one portfolio (write — editor+ role, async). Returns 422 if tracking or frequency is missing.

Input parameters:

- `assessment_source` (string): Origin tag for the request (default on_demand)
- `evidence_id` (string, required): Evidence ID (e.g., 'E-IAM-01'). Tracking row with a frequency must exist — set via scf_update_evidence first
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_window_assessments` (~134 tokens)

List recent windowed AI assessments for an evidence item (newest first). Each entry includes window bounds, frequency, file IDs, coverage, status, relevance score, findings, and cost.

Input parameters:

- `evidence_id` (string, required): Evidence ID (e.g., 'E-IAM-01') — obtain from scf_list_evidence
- `limit` (integer): Page size (1–100, default 10)
- `offset` (integer): Pagination offset — number of results to skip (default 0)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_window_assessment` (~94 tokens)

Get one windowed AI assessment by ID. Returns full detail: window bounds, frequency, file IDs, coverage, expected artifact types, status, relevance score, findings, summary, hashes, tokens, cost.

Input parameters:

- `assessment_id` (string, required): Windowed assessment UUID — obtain from scf_list_window_assessments
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_bulk_assess_windows` (~106 tokens)

Queue windowed AI assessments for up to 25 evidence IDs (write — editor+ role, async). Items without tracking or a frequency set are reported under `skipped_detail` in the response.

Input parameters:

- `evidence_ids` (array, required): Evidence IDs to assess (e.g., ['E-IAM-01','E-BCM-11']); 1–25 per request
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_window_assessment_summary` (~68 tokens)

Get aggregate windowed-assessment metrics for the organization dashboard: total windows assessed, counts by status (including `insufficient_sample`), average relevance score, and total cost in cents.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_control_assessment_composite` (~106 tokens)

Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async).

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `scf_id` (string, required): SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02')

### `scf_list_control_assessment_composites` (~192 tokens)

List rolled-up assessment composites for the org. Cursor-paginated, worst-band first (insufficient → sufficient). Filter by status/domain/computation_version. Pass next_cursor to page forward.

Input parameters:

- `computation_version` (integer): Restrict to composites computed at this algorithm version
- `cursor` (string): Opaque pagination cursor — pass next_cursor from a prior response
- `domain` (string): Filter by SCF domain code (e.g., 'BCD', 'GOV', 'AST')
- `limit` (integer): Page size (1–500, default 100)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `status` (string): Comma-separated composite_status values to include (e.g., 'insufficient,partial'). Valid values: insufficient, insufficient_sample, partial, pending, no_evidence, sufficient

### `scf_list_risks` (~116 tokens)

List risk assessments in the organization's risk register. Returns each risk's likelihood, impact, treatment status, and linked controls.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `page` (integer): 1-indexed page number (default 1)
- `per_page` (integer): Page size (1–100, default 25)
- `status` (string): Filter by treatment status (e.g., 'mitigate', 'accept', 'transfer', 'avoid')

### `scf_get_risk` (~73 tokens)

Get one risk assessment in detail: likelihood, inherent and residual impact scores, treatment plan, owner, and review date.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `risk_id` (string, required): Risk assessment ID — obtain from scf_list_risks

### `scf_create_risk` (~188 tokens)

Create a new risk assessment in the risk register (write — editor+ role). Likelihood and impact scores populate the 5×5 risk matrix.

Input parameters:

- `control_id` (string): SCF control ID to link (e.g., 'AST-01') — obtain from scf_list_controls
- `description` (string, required): Risk description (required)
- `impact` (integer, required): Inherent impact on a 1–5 scale
- `likelihood` (integer, required): Inherent likelihood on a 1–5 scale
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `owner` (string): Name or identifier of the risk owner
- `title` (string, required): Risk title (required, max ~100 chars)
- `treatment_status` (string): Treatment status: 'mitigate', 'accept', 'transfer', or 'avoid'

### `scf_get_risk_matrix` (~54 tokens)

Get the 5×5 risk matrix data for the organization — risk distribution across likelihood × impact, ready for visualization.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_risk_summary` (~49 tokens)

Get the organization's aggregate risk summary: totals by severity, treatment status breakdown, and trend data.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_custom_risks` (~57 tokens)

List the organization's custom risk definitions — org-defined risks alongside the static SCF catalog, carrying auto-generated R-ORG-N codes.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_create_custom_risk` (~135 tokens)

Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record.

Input parameters:

- `category_color` (string): Hex color for the category badge, e.g., '#6b7280' (default '#6b7280')
- `category_name` (string): Category label shown in UI (default 'Custom')
- `description` (string, required): Risk description (required)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `title` (string, required): Risk title (required, max 100 chars)

### `scf_update_custom_risk` (~145 tokens)

Update a custom risk definition's metadata — title, description, category (write — editor+ role). Only provided fields are applied.

Input parameters:

- `category_color` (string): New hex color for the category badge
- `category_name` (string): New category label
- `description` (string): New risk description
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `risk_code` (string, required): Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks
- `title` (string): New risk title (max 100 chars)

### `scf_delete_custom_risk` (~95 tokens)

Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `risk_code` (string, required): Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks

### `scf_list_custom_risk_controls` (~104 tokens)

List controls linked to a custom risk. Returns `catalog_control_ids` plus `scoped_controls` with implementation status — same shape as the built-in controls-for-risk endpoint.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `risk_code` (string, required): Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks

### `scf_add_custom_risk_control` (~132 tokens)

Link a scoped control to a custom risk (write — editor+ role). The control must already be scoped (in-scope) for this organization.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `risk_code` (string, required): Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks
- `scf_id` (string, required): SCF control ID to link (e.g., 'AST-01') — obtain from scf_list_scoped_controls

### `scf_remove_custom_risk_control` (~132 tokens)

Unlink a scoped control from a custom risk (write — editor+ role). The control and risk both remain; only the mapping is removed.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `risk_code` (string, required): Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks
- `scf_id` (string, required): SCF control ID to unlink (e.g., 'AST-01') — obtain from scf_list_custom_risk_controls

### `scf_list_vendors` (~117 tokens)

List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated.

Input parameters:

- `criticality` (string): Criticality tier filter
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `page` (integer): 1-indexed page number (default 1)
- `per_page` (integer): Page size (1–100, default 25)
- `status` (string): Lifecycle status filter

### `scf_get_vendor` (~65 tokens)

Get one vendor's detail: certifications, assessments, computed risk score, and latest research results.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_create_vendor` (~161 tokens)

Create a vendor in the TPRM registry (write — editor+ role). Platform auto-scores risk based on criticality and data handling.

Input parameters:

- `category` (string): Category label (e.g., 'SaaS', 'Infrastructure', 'Consulting')
- `contact_email` (string): Primary contact email address
- `criticality` (string): Business criticality tier (default 'medium')
- `description` (string): Short free-text description of the vendor
- `name` (string, required): Vendor legal or trading name (required)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `status` (string): Lifecycle status (default 'prospect')
- `website` (string): Vendor website URL

### `scf_update_vendor` (~139 tokens)

Update an existing vendor record (write — editor+ role). Only provided fields are applied.

Input parameters:

- `category` (string): New category label
- `contact_email` (string): New primary contact email
- `criticality` (string): New criticality tier
- `description` (string): New free-text description
- `name` (string): New vendor name
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `status` (string): New lifecycle status
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors
- `website` (string): New website URL

### `scf_trigger_vendor_research` (~117 tokens)

Queue AI security research for a vendor (write — editor+ role, async). Checks HIBP breach data, NVD vulnerabilities, and public posture. Returns a task ID; poll scf_get_vendor_research.

Input parameters:

- `domain_override` (string): Override the vendor's website domain used for research lookup (e.g., 'example.com')
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_get_vendor_research` (~76 tokens)

Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_trigger_vendor_assessment` (~190 tokens)

Queue an AI vendor security assessment (write — editor+ role, async, HTTP 202). Replaces the deprecated DPSIA trigger. Returns assessment_id + job_id; poll scf_get_vendor_assessment_status.

Input parameters:

- `additional_context` (string): Free-text context, scope notes, or specific concerns to feed the assessor (max 5000 chars)
- `assessment_type` (string): Assessment type: 'initial', 'annual', or 'adhoc' (default 'initial')
- `data_role` (string): GDPR data role (default 'Processor')
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `services_used` (string): Description of services the vendor provides, 1–2000 chars (auto-derived from the vendor record if omitted)
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_list_vendor_assessments` (~75 tokens)

List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_get_latest_vendor_assessment` (~81 tokens)

Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_get_vendor_assessment` (~103 tokens)

Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources.

Input parameters:

- `assessment_id` (string, required): Assessment UUID — obtain from scf_list_vendor_assessments or the trigger response
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_get_vendor_assessment_status` (~100 tokens)

Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment.

Input parameters:

- `assessment_id` (string, required): Assessment UUID — returned by scf_trigger_vendor_assessment
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string, required): Vendor UUID — obtain from scf_list_vendors

### `scf_get_current_user` (~30 tokens)

Get the authenticated caller's profile: name, email, organization memberships, and per-org role.

### `scf_list_organizations` (~45 tokens)

List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need.

### `scf_get_organization` (~46 tokens)

Get one organization's detail: subscription tier, member count, usage limits, and settings.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_members` (~44 tokens)

List members of one organization with their role (admin, editor, or viewer).

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_work_queue` (~34 tokens)

Get the caller's work queue: prioritized pending tasks, assignments, and action items across every organization they belong to.

### `scf_get_audit_log` (~95 tokens)

Get one organization's audit trail: field-level changes to controls, evidence, and related entities, with actor, timestamp, and before/after values.

Input parameters:

- `limit` (integer): Page size (1–100, default 50)
- `offset` (integer): Pagination offset — number of results to skip (default 0)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_notifications` (~60 tokens)

Get the caller's notifications: new assignments, comments, status changes, and system alerts.

Input parameters:

- `limit` (integer): Page size (1–100, default 25)
- `unread_only` (boolean): Return only unread notifications (default false)

### `scf_list_capability_themes` (~61 tokens)

List an organization's 11 KSI capability themes. Themes group NIST 800-53 controls into security capability areas for a high-level posture view.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_capabilities` (~50 tokens)

List an organization's capabilities. Capabilities map to systems and evidence, showing what security functions the infrastructure supports.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_systems` (~77 tokens)

List the organization's infrastructure systems — the tools and platforms that implement security capabilities. Optionally filter by linked vendor.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `vendor_id` (string): Filter to systems structurally linked to this vendor UUID — obtain from scf_list_vendors

### `scf_create_system` (~219 tokens)

Create a system in the organization's infrastructure inventory (write — editor+ role). Systems can be linked to capabilities and evidence.

Input parameters:

- `catalog_template_id` (integer): System-catalog template ID to link — obtain from scf_list_system_catalog
- `category` (string): Free-text category (e.g., 'SIEM', 'Endpoint', 'Identity')
- `description` (string): Free-text description of the system
- `name` (string, required): Human-readable system name (required)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `status` (string): Lifecycle status (default: active)
- `system_type` (string, required): System classification: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, or custom
- `vendor` (string): Legacy free-text vendor name (prefer vendor_id for a structural link)
- `vendor_id` (string): Vendor UUID to structurally link this system to — obtain from scf_list_vendors (same org)

### `scf_update_system` (~190 tokens)

Update an existing system record (write — editor+ role). All fields are optional; only provided fields are applied.

Input parameters:

- `catalog_template_id` (integer): New system-catalog template ID link — obtain from scf_list_system_catalog
- `category` (string): New free-text category
- `description` (string): New system description
- `name` (string): New system name
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `status` (string): New lifecycle status
- `system_id` (string, required): System UUID to update — obtain from scf_list_systems
- `system_type` (string): New system classification
- `vendor` (string): New legacy free-text vendor name (prefer vendor_id)
- `vendor_id` (string): New structural vendor link (UUID, same org) — obtain from scf_list_vendors

### `scf_get_capability_theme_scorecard` (~69 tokens)

Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_capability_theme` (~88 tokens)

Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `theme_code` (string, required): Capability theme code (e.g., 'ACCESS_CONTROL', 'INCIDENT_RESPONSE') — obtain from scf_list_capability_themes

### `scf_list_capability_theme_controls` (~154 tokens)

List SCF controls mapped to a capability theme (KSI), with scoping status, implementation status, and maturity level. Supports pagination and scope filtering — ideal for KSI drill-down.

Input parameters:

- `limit` (integer): Max results per page (1–200, default 50)
- `offset` (integer): Pagination offset — number of results to skip (default 0)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `scope_status` (string): Filter by scoping status (default: in_scope)
- `theme_code` (string, required): Capability theme code (e.g., 'ACCESS_CONTROL') — obtain from scf_list_capability_themes

### `scf_list_system_catalog` (~61 tokens)

List system-catalog templates — the platform's knowledge base of known vendors/tools (slug, vendor, type, recipe maturity levels). Optionally search by name.

Input parameters:

- `search` (string): Free-text search across template names, vendors, and aliases

### `scf_get_system_catalog_template` (~60 tokens)

Get one system-catalog template by slug with full detail: aliases and curated evidence-collection recipes (maturity level, steps, frequency, estimated time).

Input parameters:

- `slug` (string, required): Template slug — obtain from scf_list_system_catalog

### `scf_get_system_recipes` (~85 tokens)

Get evidence-collection recipes for a system, matched via its catalog template, alias, or fallback. Returns matched_via, the template summary, and per-maturity-level recipe steps.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `system_id` (string, required): System UUID — obtain from scf_list_systems

### `scf_generate_system_recipes` (~82 tokens)

Queue AI generation of evidence-collection recipes for a system (write — editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `system_id` (string, required): System UUID — obtain from scf_list_systems

### `scf_get_recipe_generation_status` (~72 tokens)

Get the status of a queued AI recipe-generation job for a system. Poll this after scf_generate_system_recipes.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `system_id` (string, required): System UUID — obtain from scf_list_systems

### `scf_get_capability_theme_evidence_posture` (~74 tokens)

Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_create_webhook` (~167 tokens)

Create a webhook endpoint for evidence-inbox ingestion (write — admin role). Returns the plaintext HMAC signing secret exactly once — store it immediately; it cannot be retrieved later.

Input parameters:

- `allowed_evidence_ids` (array): Restrict ingestion to specific evidence IDs (e.g., ['ERL-IAM-001']); omit to allow any
- `description` (string): Free-text description of what this endpoint is for
- `name` (string, required): Human-readable label (e.g., 'Splunk SIEM', 'AWS Config')
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations
- `rate_limit_per_minute` (integer): Per-endpoint rate limit in requests/min (1–10000); omit to use the org default

### `scf_list_webhooks` (~51 tokens)

List the organization's webhook endpoints (newest first). Returns name, status, delivery count, and secret prefix.

Input parameters:

- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_get_webhook` (~68 tokens)

Get one webhook endpoint's detail: delivery stats, allowed evidence IDs, and rate-limit configuration.

Input parameters:

- `endpoint_id` (string, required): Webhook endpoint UUID — obtain from scf_list_webhooks
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_delete_webhook` (~81 tokens)

Revoke a webhook endpoint — soft-delete that marks it inactive (destructive write — admin role). Future deliveries return 403; the record remains for audit.

Input parameters:

- `endpoint_id` (string, required): Webhook endpoint UUID — obtain from scf_list_webhooks
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_rotate_webhook_secret` (~82 tokens)

Rotate the HMAC signing secret for a webhook endpoint (write — admin role). The old secret is invalidated immediately. Returns the new plaintext secret exactly once.

Input parameters:

- `endpoint_id` (string, required): Webhook endpoint UUID — obtain from scf_list_webhooks
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

### `scf_list_webhook_deliveries` (~116 tokens)

List delivery logs for a webhook endpoint (newest first). Each entry shows signature validation result, processing status, evidence ID, and timestamps.

Input parameters:

- `endpoint_id` (string, required): Webhook endpoint UUID — obtain from scf_list_webhooks
- `limit` (integer): Page size (1–200, default 50)
- `offset` (integer): Pagination offset — number of deliveries to skip (default 0)
- `org_id` (string, required): Organization UUID — obtain from scf_list_organizations

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/app-scfcontrolsplatform-mcp-server-scf/mcp-server-scf#diagnostics

## Score history

- 2026-08-03: 80
- 2026-08-02: 80
- 2026-08-01: 5
- 2026-07-31: 21
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/mcp-server-scf
- Socket report: https://socket.dev/npm/package/mcp-server-scf
- Repository: https://github.com/MarkAC007/mcp-server-scf
- Website: https://scfcontrolsplatform.com/
- Changelog RSS feed: https://verifymcp.io/servers/app-scfcontrolsplatform-mcp-server-scf/mcp-server-scf/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-scfcontrolsplatform-mcp-server-scf/mcp-server-scf/changelog.json
- HTML version of this page: https://verifymcp.io/servers/app-scfcontrolsplatform-mcp-server-scf/mcp-server-scf