Hackathon 12 MCP Compliance

🚀 MCP Compliance Project

A project for compliance that offers command-line tools and an MCP server for agents to interact with compliance data.

🚀 Quick Start

To set up the project as quickly as possible:

# Create a directory for MCP compliance binaries
mkdir -p ~/.mcp-compliance/bin

# Add it to your PATH environment variable (add it to .bashrc or .zshrc for persistence)
export PATH=$PATH:~/.mcp-compliance/bin

# Clone the repository
git clone https://github.com/grafana/hackathon-12-mcp-compliance.git
cd hackathon-12-mcp-compliance

# Build and deploy locally
make deploy-local

Now you can configure your agent (Cursor or Claude Desktop) to use the MCP compliance server. Refer to the Getting Started Guide for configuration details.

✨ Features

Overview

The FedRAMP-compliant MCP server aims to support users in three main stages of their entire compliance journey:

1. Understand - Learn about security controls, their requirements, and how they apply to your system.
2. Implement - Design and implement controls in your system to meet compliance requirements.
3. Evidence Collection - Collect and record evidence to prove compliance with controls.

This project provides tools for handling FedRAMP compliance data, including:

1. A command-line tool for processing and querying FedRAMP baseline data.
2. An MCP server that provides compliance data to large language model (LLM) agents.

Roadmap

Currently, the project lacks an automated evidence collection feature. There is a need for a way to securely store potentially sensitive data in a shared location, along with appropriate access control lists (ACLs) and data protection mechanisms. This is a feature planned to be added in future hackathons or other roadmap timelines.

📚 Documentation

• Getting Started Guide - Instructions for setting up and using the project.
• Concept of Operations - A detailed explanation of the system architecture and data flow.

💻 Usage Examples

MCP Server

The MCP server provides the following tools for LLM agents:

• get_control: Get detailed information about a specific control.
• get_control_family: Get all controls in a specific family.
• list_control_families: List all control families in the program.
• search_controls: Search for controls by keyword.
• get_control_evidence_guidance: Get detailed guidance on evidence for a specific control.

📦 Data Sources

The FedRAMP baseline files are sourced from the official GSA FedRAMP Automation GitHub repository:

• FedRAMP Rev 5 HIGH Baseline
• FedRAMP Rev 5 MODERATE Baseline