app.scfcontrolsplatform/mcp-server-scf
NPM · MCP-SERVER-SCF · SCANNED SEP 20
MCP server for the SCF Controls Platform — 187 tools for controls, evidence, risk, and TPRM.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to MarkAC007/mcp-server-scf). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 20095 tokens (~107/item across 187 items; 187 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management91
- Stability check failed: the tool surface changed between 2.1.0 and 3.4.2: 7 tool removals, 0 breaking changes, 59 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 15 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 187 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the app.scfcontrolsplatform/mcp-server-scf server?
app.scfcontrolsplatform/mcp-server-scf runs locally as an npm package, launched with npx -y mcp-server-scf. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · mcp-server-scf
claude mcp add app-scfcontrolsplatform-mcp-server-scf -- npx -y mcp-server-scf
{
"mcpServers": {
"app-scfcontrolsplatform-mcp-server-scf": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf"
]
}
}
} {
"servers": {
"app-scfcontrolsplatform-mcp-server-scf": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf"
]
}
}
} codex mcp add app-scfcontrolsplatform-mcp-server-scf -- npx -y mcp-server-scf
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"app-scfcontrolsplatform-mcp-server-scf": {
"type": "local",
"command": [
"npx",
"-y",
"mcp-server-scf"
],
"enabled": true
}
}
} openclaw mcp add app-scfcontrolsplatform-mcp-server-scf --command npx --arg -y --arg mcp-server-scf
mcp_servers:
app-scfcontrolsplatform-mcp-server-scf:
command: "npx"
args: ["-y", "mcp-server-scf"] {
"McpServers": {
"app-scfcontrolsplatform-mcp-server-scf": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"mcp-server-scf"
]
}
}
} assistant mcp add app-scfcontrolsplatform-mcp-server-scf -t stdio -c npx -a -y mcp-server-scf
{
"mcpServers": {
"app-scfcontrolsplatform-mcp-server-scf": {
"command": "npx",
"args": [
"-y",
"mcp-server-scf"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 88 to 91.
- 18 Sept 26 +1
- Package version: 2.0.1 → 3.4.2 functional
- 16 Sept 26 −3
- Stability: pass → fail ▼ security
- 15 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- 14 Sept 26 −14
- Known CVEs: pass → unverified ▼ security
- Stability: 0.93 → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Schema quality: 13281 → 20095 ▼ functional
- Dependency health: 0.84 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: unverified → pass ▲ functional
- Package version: 3.0.0 → 3.4.2 functional
- Package version: 3.0.0 → 3.4.0 functional
- Package version: 3.0.0 → 3.2.0 functional
- 13 Sept 26 0
- Security disclosure: pass → unverified ▼ functional
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/mcp-server-scf@3.4.2
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | MarkAC007/mcp-server-scf |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/MarkAC007/mcp-server-scf/.github/workflows/auto-release.yml@refs/heads/main |
| Rekor log index | 2831944435 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:864b65ab73c8ad6895c0cb94a34e8e8c77fb60f3605ce4e019c1bb0382be5675b733fdd2f861d798f63a3acd72539efffeb70c25f95b3f0000fcfba33 |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
scf_get_catalog_reconciliation_status ~64
Get this organization's catalog position (read — viewer role): its catalog version, the platform's current version, and whether reconciliation is due or in flight. Start here.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_change_cursor ~70
Cheap has-anything-changed probe (read — viewer role): newest audit timestamp and row count for one organization. Compare with the pair you last saw; poll this before re-pulling the audit log.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_control ~75
Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog.
| Name | Type | Req | Description |
|---|---|---|---|
| scf_id | string | yes | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'IAC-15', 'GOV-02') |
No output schema declared.
No examples provided.
scf_get_control_assessment_composite ~106
Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async).
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| scf_id | string | yes | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') |
No output schema declared.
No examples provided.
scf_get_controls_for_risk ~97
List the controls that address a risk code (read — viewer role). Works for catalog risks (R-XX-N via the SCF mapping) and custom risks (R-ORG-N via the org's control mappings).
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| risk_code | string | yes | Risk code — catalog R-XX-N or custom R-ORG-N |
No output schema declared.
No examples provided.
scf_get_current_user ~30
Get the authenticated caller's profile: name, email, organization memberships, and per-org role.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
scf_get_document ~84
Get one generated document in full (read — viewer role): metadata plus every section with its merge state — clean, edited, conflicted or pending retirement. Use this to read a document.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | Generated document UUID — obtain from scf_list_documents |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_document_generation_status ~65
Poll this organization's in-flight document generation (read — viewer role). Returns {status: 'idle'} when nothing is running. Call after scf_generate_documents until it completes.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_document_history ~79
Get a document's version and transition history (read — viewer role): who moved it between lifecycle states, when, why, and what each generation version changed.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | Generated document UUID — obtain from scf_list_documents |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_document_section_generated ~132
Get the generator's own version of a section, ignoring any human edit (read — viewer role). Use it to see what the platform would produce before resolving a conflict.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | Generated document UUID — obtain from scf_list_documents |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| section_id | string | yes | Section identifier from the document detail (scf_get_document). May contain slashes — pass it exactly as returned, unescaped. |
| version | integer | – | Generation version number to read; omit for the latest |
No output schema declared.
No examples provided.
scf_get_document_settings ~61
Get the organization's document-generation settings (read — viewer role): whether doc-gen is enabled, whether derivative generators are enabled, and the SCF licence acknowledgement state.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_domain ~85
Get one SCF domain with its controls (read, no org). Deprecated controls are excluded unless include_deprecated is set; a deprecated domain still resolves, badged.
| Name | Type | Req | Description |
|---|---|---|---|
| identifier | string | yes | Domain code or slug, e.g. 'IAC' — obtain from scf_list_domains |
| include_deprecated | boolean | – | Include deprecated controls (default false) |
No output schema declared.
No examples provided.
scf_get_engagement ~69
Get one audit engagement's detail (read — viewer role, or an auditor assigned to this engagement).
| Name | Type | Req | Description |
|---|---|---|---|
| engagement_id | string | yes | Audit engagement UUID — obtain from scf_list_engagements |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_engagement_presentation ~111
Get the engagement's scope presented natively in one of its frameworks (read — viewer, or assigned auditor): SCF controls organised by that framework's own structure, as an auditor reads them.
| Name | Type | Req | Description |
|---|---|---|---|
| engagement_id | string | yes | Audit engagement UUID — obtain from scf_list_engagements |
| framework | string | yes | Framework to present from — must be one of the engagement's own frameworks |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_engagement_query ~89
Get one auditor query with its full response thread (read — viewer role, or an assigned auditor).
| Name | Type | Req | Description |
|---|---|---|---|
| engagement_id | string | yes | Audit engagement UUID — obtain from scf_list_engagements |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| query_id | string | yes | Query UUID — obtain from scf_list_engagement_queries |
No output schema declared.
No examples provided.
scf_get_engagement_scope ~86
Get an engagement's frozen control scope (read — viewer role, or an assigned auditor). Rows carry a catalog lifecycle badge, so controls deprecated since the freeze still render, marked.
| Name | Type | Req | Description |
|---|---|---|---|
| engagement_id | string | yes | Audit engagement UUID — obtain from scf_list_engagements |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence ~93
Get one evidence tracking record (read — viewer role): tracked flag, collection method, owner, assignee, frequency, system, maturity level and its catalog deprecation badge.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Catalog evidence ID, e.g. E-IAM-01 — obtain from scf_list_evidence_catalog |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_assessment ~124
Get the AI assessment for an evidence file: status, relevance score (0–100), structured findings, summary, and audit metadata (model, tokens, cost). Poll after scf_trigger_evidence_assessment.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence |
| file_id | string | yes | Evidence file UUID — obtain from scf_list_evidence_files |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_assessment_summary ~64
Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_file ~110
Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence |
| file_id | string | yes | Evidence file UUID — obtain from scf_list_evidence_files |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_health ~58
Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_item_maturity ~92
Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Evidence ID (e.g., 'E-RSK-02') — obtain from scf_list_evidence |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_maturity ~54
Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_suggestions ~93
Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Evidence ID (e.g., 'E-RSK-02') — obtain from scf_list_evidence |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_upgrade_recommendations ~96
Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions — the same guidance shown in the platform UI.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Evidence ID (e.g., 'E-RSK-02') — obtain from scf_list_evidence |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_validation ~112
Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence |
| file_id | string | yes | Evidence file UUID — obtain from scf_list_evidence_files |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_evidence_validation_summary ~62
Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_frequency_health ~60
Report evidence whose declared frequency disagrees with the observed upload cadence over the last 90 days (read — viewer role). Only misaligned items are returned.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_latest_vendor_assessment ~81
Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| vendor_id | string | yes | Vendor UUID — obtain from scf_list_vendors |
No output schema declared.
No examples provided.
scf_get_notifications ~60
Get the caller's notifications: new assignments, comments, status changes, and system alerts.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size (1–100, default 25) |
| unread_only | boolean | – | Return only unread notifications (default false) |
No output schema declared.
No examples provided.
scf_get_org_work_queue ~85
Get one organization's consolidated GRC work queue (read — viewer role): overdue evidence tasks, blocking controls, stale collection schedules. assigned_to_me narrows to the caller.
| Name | Type | Req | Description |
|---|---|---|---|
| assigned_to_me | boolean | – | Only items owned by or assigned to the caller (default false) |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_organization ~46
Get one organization's detail: subscription tier, member count, usage limits, and settings.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_recipe_generation_status ~72
Get the status of a queued AI recipe-generation job for a system. Poll this after scf_generate_system_recipes.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| system_id | string | yes | System UUID — obtain from scf_list_systems |
No output schema declared.
No examples provided.
scf_get_reconciliation_run ~90
Get one reconciliation run in detail (read — viewer role): the computed diff, every deprecated entity needing a decision, and the planned action currently recorded against each.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| run_id | string | yes | Reconciliation run UUID — obtain from scf_list_reconciliation_runs or scf_preview_catalog_reconciliation |
No output schema declared.
No examples provided.
scf_get_risk ~73
Get one risk assessment in detail: likelihood, inherent and residual impact scores, treatment plan, owner, and review date.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| risk_id | string | yes | Risk assessment ID — obtain from scf_list_risks |
No output schema declared.
No examples provided.
scf_get_risk_matrix ~54
Get the 5×5 risk matrix data for the organization — risk distribution across likelihood × impact, ready for visualization.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_risk_profile ~68
Get the organization's risk profile (read — viewer role): the severity thresholds that band the 5×5 matrix into low, medium, high and critical. Auto-created with defaults if unset.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_risk_summary ~49
Get the organization's aggregate risk summary: totals by severity, treatment status breakdown, and trend data.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_risks_for_control ~89
List the risk codes a control addresses and this organization's assessments of them (read — viewer role). Control-to-risk traceability from the SCF catalog mapping.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| scf_id | string | yes | SCF control ID in DOMAIN-NN format, e.g. IAC-01 |
No output schema declared.
No examples provided.
scf_get_scoped_control ~96
Get one scoped control in detail: owner, implementation notes, evidence links, and audit history. Identify by scf_id, not by UUID.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| scf_id | string | yes | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') — NOT the UUID |
No output schema declared.
No examples provided.
scf_get_scoping_stats ~50
Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_system ~79
Get one system from the organization's inventory (read — viewer role): name, type, vendor, description, catalog template link and the evidence it is configured to provide.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| system_id | string | yes | System UUID — obtain from scf_list_systems |
No output schema declared.
No examples provided.
scf_get_system_catalog_template ~60
Get one system-catalog template by slug with full detail: aliases and curated evidence-collection recipes (maturity level, steps, frequency, estimated time).
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | Template slug — obtain from scf_list_system_catalog |
No output schema declared.
No examples provided.
scf_get_system_recipes ~85
Get evidence-collection recipes for a system, matched via its catalog template, alias, or fallback. Returns matched_via, the template summary, and per-maturity-level recipe steps.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| system_id | string | yes | System UUID — obtain from scf_list_systems |
No output schema declared.
No examples provided.
scf_get_systems_for_evidence ~95
Find every system that can provide a given evidence type (read — viewer role) — the inverse of the per-system capability list. Filter by capability status.
| Name | Type | Req | Description |
|---|---|---|---|
| capability_status | string | – | Filter by capability status |
| evidence_id | string | yes | Catalog evidence ID, e.g. E-IAM-01 |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_team ~73
Get one team with its full roster and advisory health warnings (read — viewer role), e.g. no primary owner or no members.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| team_id | string | yes | Team UUID — obtain from scf_list_teams |
No output schema declared.
No examples provided.
scf_get_upcoming_evidence ~86
List evidence whose next collection falls due within N days (read — viewer role), computed from each item's frequency and last upload. The daily 'what is due' view.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look-ahead window in days (1–90, default 14) |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
No output schema declared.
No examples provided.
scf_get_vendor ~65
Get one vendor's detail: certifications, assessments, computed risk score, and latest research results.
| Name | Type | Req | Description |
|---|---|---|---|
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| vendor_id | string | yes | Vendor UUID — obtain from scf_list_vendors |
No output schema declared.
No examples provided.
scf_get_vendor_assessment ~103
Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources.
| Name | Type | Req | Description |
|---|---|---|---|
| assessment_id | string | yes | Assessment UUID — obtain from scf_list_vendor_assessments or the trigger response |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| vendor_id | string | yes | Vendor UUID — obtain from scf_list_vendors |
No output schema declared.
No examples provided.
scf_get_vendor_assessment_status ~100
Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment.
| Name | Type | Req | Description |
|---|---|---|---|
| assessment_id | string | yes | Assessment UUID — returned by scf_trigger_vendor_assessment |
| org_id | string | yes | Organization UUID — obtain from scf_list_organizations |
| vendor_id | string | yes | Vendor UUID — obtain from scf_list_vendors |
No output schema declared.
No examples provided.
What is the app.scfcontrolsplatform/mcp-server-scf server?
app.scfcontrolsplatform/mcp-server-scf is listed in the public MCP registry as app.scfcontrolsplatform/mcp-server-scf. MCP server for the SCF Controls Platform, 187 tools for controls, evidence, risk, and TPRM. This page covers its npm package (mcp-server-scf).
Is the app.scfcontrolsplatform/mcp-server-scf server safe to use?
app.scfcontrolsplatform/mcp-server-scf scores 95 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the app.scfcontrolsplatform/mcp-server-scf server expose?
app.scfcontrolsplatform/mcp-server-scf exposes 187 tools: scf_list_controls, scf_get_control, scf_list_frameworks, scf_list_domains, scf_list_evidence_catalog, and 182 more. Their descriptions and schemas cost roughly 20,095 tokens of context every time the server is loaded.
Is the app.scfcontrolsplatform/mcp-server-scf server still maintained?
app.scfcontrolsplatform/mcp-server-scf is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the app.scfcontrolsplatform/mcp-server-scf server under?
app.scfcontrolsplatform/mcp-server-scf declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.