FedRAMP 20x MCP Server

An MCP (Model Context Protocol) server that provides access to FedRAMP 20x security requirements and controls with Azure-first guidance.

Overview

This server loads FedRAMP 20x data from the official FedRAMP documentation repository and provides tools for querying requirements by control, family, or keyword.

Data Sources:

• Requirements Data: JSON files from github.com/FedRAMP/docs (root directory)
• Documentation: Markdown files from github.com/FedRAMP/docs/tree/main/docs

Azure Focus: All implementation examples, architecture patterns, and vendor recommendations prioritize Microsoft Azure services (Azure Government, Microsoft Entra ID, Azure Key Vault, AKS, Azure Functions, Bicep, etc.) while remaining cloud-agnostic where appropriate.

Data Coverage

The server provides access to 321 requirements (199 FRRs + 72 KSIs + 50 FRDs) across FedRAMP 20x documents:

FedRAMP Requirements (FRR) - 199 requirements across 10 families:

• ADS - Authorization Data Sharing (20 requirements)
• CCM - Collaborative Continuous Monitoring (25 requirements)
• FSI - FedRAMP Security Inbox (16 requirements)
• ICP - Incident Communications Procedures (9 requirements)
• MAS - Minimum Assessment Scope (12 requirements)
• PVA - Persistent Validation and Assessment (22 requirements)
• RSC - Recommended Secure Configuration (10 requirements)
• SCN - Significant Change Notifications (22 requirements)
• UCM - Using Cryptographic Modules (4 requirements)
• VDR - Vulnerability Detection and Response (57 requirements)
• KSI - Key Security Indicators (2 requirements)

Key Security Indicators (KSI) - 72 indicators across 11 families:

• AFR - Architecture, Features, and Resources (11 indicators)
• CED - Continuous Evidence Delivery (4 indicators)
• CMT - Continuous Monitoring and Testing (5 indicators)
• CNA - Cloud Native Architecture (8 indicators)
• IAM - Identity and Access Management (7 indicators)
• INR - Incident and Near-Miss Reporting (3 indicators)
• MLA - Monitoring, Logging, and Alerting (8 indicators)
• PIY - Privacy and Transparency (8 indicators)
• RPL - Resilience and Recovery Planning (4 indicators)
• SVC - Secure Coding and Vulnerability Management (10 indicators)
• TPR - Third-Party Risk Management (4 indicators)

FedRAMP Definitions (FRD) - 50 official term definitions

Features

• 🎯 Automated Evidence Collection (NEW): Automation guidance for 65 active KSIs with Azure-native services, ready-to-use queries, and artifact specifications
• Query by Control: Get detailed information about specific FedRAMP requirements
• Query by Family: List all requirements within a family
• Keyword Search: Search across all requirements using keywords
• FedRAMP Definitions: Look up official FedRAMP term definitions
• Key Security Indicators: Access and query FedRAMP Key Security Indicators (KSI) with implementation status
• Documentation Search: Search and retrieve official FedRAMP documentation markdown files
• Dynamic Content: Automatically discovers and loads all markdown documentation files
• Implementation Planning: Generate strategic interview questions to help product managers and engineers think through FedRAMP 20x implementation considerations
• AST-Powered Code Analysis: Advanced Abstra

... View full README on GitHub