EZ RMF MCP Server

MCP (Model Context Protocol) server for interacting with the EZ RMF system - a comprehensive Risk Management Framework compliance and implementation tool.

Features

• Project Management: Create, list, update, and get statistics for RMF projects
• Control Management: List, filter, and bulk update NIST 800-53 security controls
• Policy Sections: Create and manage policy documentation with Markdown and Mermaid diagram support
• Evidence Management: Upload, list, and delete evidence artifacts for controls
• ODP Management: Set and manage Organization Defined Parameters
• Guided Workflows: Interactive prompts to guide through RMF implementation phases

Quick Start with npx

Run the MCP server directly without installation:

# Set your bearer token
export EZRMF_BEARER_TOKEN="your-token-here"

# Optionally set API URL (defaults to http://localhost:8000)
export EZRMF_API_URL="http://your-api-url"

# Run the server
npx ezrmf-mcp

Installation

Global Installation

Install globally to use the ezrmf-mcp command:

npm install -g ezrmf-mcp

Then run:

ezrmf-mcp

Local Installation

Add to your project:

npm install ezrmf-mcp

Usage with Claude Desktop

Add to your Claude Desktop configuration (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "ezrmf": {
      "command": "npx",
      "args": ["ezrmf-mcp"],
      "env": {
        "EZRMF_BEARER_TOKEN": "your-token-here",
        "EZRMF_API_URL": "http://127.0.0.1:8000"
      }
    }
  }
}

Or if installed globally:

{
  "mcpServers": {
    "ezrmf": {
      "command": "ezrmf-mcp",
      "env": {
        "EZRMF_BEARER_TOKEN": "your-token-here",
        "EZRMF_API_URL": "http://127.0.0.1:8000"
      }
    }
  }
}

Development

Setup

1. Clone the repository:

git clone https://github.com/shebashio/ezrmf-mcp.git
cd ezrmf-mcp

2. Install dependencies:

npm install

3. Build the TypeScript code:

npm run build

4. Run in development mode:

npm run dev

Environment Variables

• EZRMF_BEARER_TOKEN (required) - Authentication token for the EZ RMF API
• EZRMF_API_URL (optional) - API endpoint URL (defaults to http://localhost:8000)

Available Tools

Project Tools

• project_list - List all projects
• project_create - Create a new RMF project
• project_get - Get project details
• project_update - Update project information
• project_stats - Get project implementation statistics

Control Tools

• control_list - List controls with filtering options
• control_get - Get detailed control information
• control_implementation_set - Update control implementation status
• control_bulk_update - Update multiple controls at once
• control_families - Get control family summary
• policy_section_save - Save policy documentation for a control
• policy_section_get - Retrieve policy documentation

Evidence Tools

• evidence_list - List evidence for a control
• evidence_upload - Upload evidence metadata
• evidence_delete - Delete evidence
• evidence_bulk_upload - Upload multiple evidence items

ODP Tools

• odp_list - List ODPs for a project or control
• odp_set - Set ODP values
• odp_delete - Delete a previously set ODP value
• odp_undefined_list - List ODPs that need values

Guided Prompts

The server includes interactive prompts to guide through:

• Initial project setup
• Control implementation workflow
• Policy and procedure development
• Evidence collection
• System Security Plan (SSP) preparation

License

Copyright © 2024 Shebash.io. All rights reserved.

This software is proprietary and confidential. Unauthorized copying, distribution, modification, or use of this software, in whole or in part, is strictly prohibited without the express written permission of Shebash.io.

For licensing inquiries, please contact: [email protected]

Contributing

This is a proprietary project. External contributions are not accepted at this time.