app.scfcontrolsplatform/mcp-server-scf

Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research.

Get one webhook endpoint's detail: delivery stats, allowed evidence IDs, and rate-limit configuration.

Get one windowed AI assessment by ID. Returns full detail: window bounds, frequency, file IDs, coverage, expected artifact types, status, relevance score, findings, summary, hashes, tokens, cost.

Get aggregate windowed-assessment metrics for the organization dashboard: total windows assessed, counts by status (including `insufficient_sample`), average relevance score, and total cost in cents.

Get the caller's work queue: prioritized pending tasks, assignments, and action items across every organization they belong to.

List SCF assessment objectives — the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination.

List user assignments to controls, evidence items or tasks (read — viewer role). Filter by item type and id, or by user_id to see one person's workload.

List an organization's capabilities. Capabilities map to systems and evidence, showing what security functions the infrastructure supports.

List SCF controls mapped to a capability theme (KSI), with scoping status, implementation status, and maturity level. Supports pagination and scope filtering — ideal for KSI drill-down.

List an organization's 11 KSI capability themes. Themes group NIST 800-53 controls into security capability areas for a high-level posture view.

List the comment thread on one control, evidence item or task (read — viewer role), oldest first, with authors, mentions and reply structure.

List the compensating controls recorded against a vendor's gaps (read — viewer role): the gap, the control that offsets it, its effectiveness rating and risk-reduction notes.

List rolled-up assessment composites for the org. Cursor-paginated, worst-band first (insufficient → sufficient). Filter by status/domain/computation_version. Pass next_cursor to page forward.

List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search.

List controls linked to a custom risk. Returns `catalog_control_ids` plus `scoped_controls` with implementation status — same shape as the built-in controls-for-risk endpoint.

List the organization's custom risk definitions — org-defined risks alongside the static SCF catalog, carrying auto-generated R-ORG-N codes.

List the SCF domains this organization can currently generate documents for (read — viewer role). A domain appears only when it has enough scoped controls to produce a document.

List the ISMS document generators available to this organization (read — viewer role): generator name, document type, tier, derivative flag. Call before scf_generate_documents.

List generated ISMS documents (read — viewer role): lifecycle status, section counts, unresolved conflicts, pending retirements, and whether the document is stale against current org inputs.

List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control).

List the auditors granted read access to one engagement (read — viewer role). Each grant carries its status: invited, active or revoked.

List an engagement's structured auditor queries (read — viewer role, or an assigned auditor). A query is an auditor's question against one control, with its responses and status.

List the organization's audit engagements (read — viewer role). Each entry carries its frameworks, status, dates and the catalog version its scope was frozen against.

List evidence items tracked against an organization's controls. Returns each item's tracking status, maturity level, and linked controls. Optionally filter by system.

List evidence items from the SCF reference catalog — the 272 standard evidence types that can be collected to demonstrate control implementation. Supports free-text search and pagination.

List all files uploaded or ingested for an evidence item. Returns filename, content type, upload timestamp, validation status, and a pre-signed download URL (15-min expiry).

List the organization's evidence coverage gaps: evidence required by in-scope controls that is not yet tracked, with overall coverage percentage.

List evidence collection tasks — the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.

List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names.

List the platform's business functions (read — any member): the fixed set every team aligns to, identical for every tenant. Needed for the function_id on scf_create_team.

List members of one organization with their role (admin, editor, or viewer).

List engagements the caller holds an active auditor grant on, across organizations (read). The auditor's own view — use scf_list_engagements for the organization-side list.

List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need.

List this organization's catalog reconciliation runs, newest first (read — viewer role), with each run's status and target version.

List risk assessments in the organization's risk register. Returns each risk's likelihood, impact, treatment status, and linked controls.

List controls scoped to the organization with implementation status. Filter by scope status, domain, framework, CSF function, weighting, or free-text search. Paginated.

List the evidence types a system can provide and how (read — viewer role): capability status potential/configured/active, collection method, confidence and data format.

List system-catalog templates — the platform's knowledge base of known vendors/tools (slug, vendor, type, recipe maturity levels). Optionally search by name.

List the organization's infrastructure systems — the tools and platforms that implement security capabilities. Optionally filter by linked vendor.

Map of which team owns which scoped control or evidence item (read — viewer role). Unfiltered returns the whole map; narrow with item_ids, team_id or accountable_only.

List the organization's teams (read — viewer role). Archived teams are hidden unless include_inactive is set; they are kept, never deleted, so history still resolves.

List remediation action items for one vendor, or across every vendor when vendor_id is omitted (read — viewer role). Filter by status or priority.

List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record.

List a vendor's certifications (read — viewer role): name, issuing body, certificate number, status, issue and expiry dates, scope and verification URL.

List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated.

List delivery logs for a webhook endpoint (newest first). Each entry shows signature validation result, processing status, evidence ID, and timestamps.

List the organization's webhook endpoints (newest first). Returns name, status, delivery count, and secret prefix.

List recent windowed AI assessments for an evidence item (newest first). Each entry includes window bounds, frequency, file IDs, coverage, status, relevance score, findings, and cost.

Mark notifications read for the current user (write — self only): one by notification_id, or every notification when all=true. Acknowledge after processing scf_get_notifications.

Create a reconciliation preview run (write — admin role): what moving to the target catalog version would do to scoped controls, evidence and mappings. Changes nothing until apply.